Difference between revisions of "SME Server:Documentation:FAQ/fr"
| Line 956: | Line 956: | ||
| − | {{:Booting}} | + | {{:Booting/fr}} |
{{:Log_Files}} | {{:Log_Files}} | ||
Revision as of 22:27, 27 November 2017
--Prbird)
Aider le Projet SME Server
Faire un don via votre compte du forum de contribs.org
Le meilleur moyen est d'utiliser l' option Donate (située dans la barre de menu) dans le forums. Vous êtes libre de choisir le montant et vous pouvez décider de faire un don mensuel, annuel ou seulement une fois.
L'avantage de faire un don via votre compte du forum, c'est que votre nom d'utilisateur recevra un badge, montrant l'état et le montant de votre don.
Les donations sont faites par PayPal
Faire un don directement par PayPal
La deuxième façon est de donner de l'argent en utilisant directement PayPal. Il suffit de cliquer sur le bouton ci-dessous pour être redirigé vers la page de don à Koozali SME Server, mais contrairement à un don via les forums, vous ne recevrez pas de badges comme donateur sur le forum.
Les donations sont faites par PayPal
- Merci infiniment pour votre aide
- Merci infiniment pour votre aide
En cours de traduction, merci pour votre aide. JP Pialasse
Foire aux Questions
Cette section répertorie les Question Fréquemment Posées (FAQ) à propos de SME. Les problèmes auxquels font face les personnes installant SME pour la première fois, ou en mettant à jour une version antérieure peuvent trouver leur réponse ici.
Si votre question ne trouve pas de réponse ici, il est probable que vous soyez en face d'une question rarement posée (RAQ), dans ce cas vous devriez chercher dans Bugzilla, cependant vous pourriez aussi faire appel à la communauté francophone. En premier lieu vous pouvez consulter le site de Grand Pa, ensuite le wiki francophone. Enfin vous pouvez demander un peu d'aide sur le forum de contribs, sur l'irc chat.freenode.net:6667 canal #sme-fr, ou enfin auprès le newsgroup alt.e-smith.fr.
|
Voir, s.v.p. comment obtenir un compte wiki |
Problèmes à l'installation
Problème avec l’installateur pour indiquer où sont les fichiers d'installation
Quelques problèmes ont été rapportés concernant l'installation depuis un CD-ROM PATA. Le système est capable de démarrer (boot) depuis le CD-ROM mais après vous êtes invité(e) à spécifier l'emplacement de l'image d'installation. Ceci peut aussi bien signifier que le disque n'est pas lisible, ou que le lecteur de CD-ROM n'est pas reconnu / pris en charge par l'installateur. Si vous avez vérifié le disque à l'aide de l'outil fourni et que vous êtes certain(e) que le disque est bon, vous pouvez ajouter l'option all-generic-ide à l'invite de démarrage (boot prompt) avant de démarrer l'installateur de cette façon :
linux all-generic-ide
Mises à jours Yum
Quels dépôts (repositories) devraient être actifs (enabled)
Vous devriez avoir ces dépôts actifs (bleu dans le gestionnaire du serveur - serveur-manager)
CentOS - os CentOS - updates SME Server - addons SME Server - extras SME Server - os SME Server - updates.
La commande suivante peut être utilisée pour afficher les noms et statuts de tous les dépôts configurés.
/sbin/e-smith/audittools/repositories
Comme cette commande liste les entrées db, les noms équivalents des dépôts activés par défaut mentionnés ci-dessus sont (listé dans le même ordre) :
base: enabled updates: enabled smeaddons: enabled smeextras: enabled smeos: enabled smeupdates: enabled
NE PAS activer SME Server - updates testing qui contient des logiciels en test bêta, à moins que :
- il s'agisse d'un serveur de TEST, donc PAS d'un serveur en production
ou
- vous voulez faire partie de l'équipe de test des bogues.
De plus :
- SME Server - test contient des paquets en version alpha (en développement avant test bêta) ;
- SME Server - dev contient des paquets automatiquement construits au fur et à mesure des modifications des développeurs. Il contient donc beaucoup d'expérimentations qui sont incomplètes et possiblement mutuellement incompatibles.
- Pour une autre méthode pour remettre à zéro la configuration des dépôts, lisez Adding_Software#Restoring_Default_Yum_Repositories.
Reconfiguration (post-upgrade) et redémarrage
- Quand est-ce qu'une reconfiguration (post-upgrade) et un redémarrage sont nécessaires ?
L'installateur "yum" du gestionnaire de serveur n'a aucun moyen de déterminer si les fichiers de configuration changeront, si tous sont re-expanded ou de savoir quels binaires ont changé (ou utilisent des librairies qui ont maintenant changé) et doivent donc être redémarés. La seule option sécuritaire est de reconfigurer et de tout redémarrer.
Après avoir cliqué sur Reconfigurer, vérifier le message d'état et le redémarrage effectif du serveur. Des circonstances rares peuvent empêcher la reconfiguration de s'opérer. Dans ce cas, exécutez la commande :
signal-event post-upgrade; signal-event reboot
Mise à niveau de SME 7.x à SME 7.2
Voir Updating_to_SME_7.2#Yum_Update
Avertissement dans le rapport de courriel de rkhunter
Après la mise à niveau vers SME Server 7.4, l'utilisateur admin peut recevoir le message suivant de rkhunter :
Attention : les options de configuration de SSH et de rkhunter doivent être les mêmes :
SSH configuration option 'PermitRootLogin': yes
Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no
Ce message d'alerte n'indique pas une erreur ou un problème de sécurité des logiciels et peut être ignoré. Le problème doit être réglé dans une version future. Voir ce rapport de bogue pour plus d'information.
En juin 2009 smeserver-rkhunter a été retiré de smeos et une contribution a été créée.
Vous devez, soit finir le retrait de cette fonctionnalité par la commande :
rpm -e rkhunter
soit la réinstaller à partir du dépôt smecontribs :
yum install smeserver-rkhunter --enablerepo=smecontribs
Fréquence
- Par defaut, l'implémentation de yum sur SME vérifie l'existence de mises à jour quotidiennement ; ceci peut être personnalisé pour une vérification hedomadaire :
config setprop yum check4updates weekly;signal-event yum-modify
ou mensuelle :
config setprop yum check4updates weekly;signal-event yum-modify
ou, pour revenir au réglage par défaut :
config delprop yum check4updates;signal-event yum-modify
Généralités
- Attendez, s'il vous plaît - Yum est en fonctionnement (prereposetup)
Cela signifie que yum travaille sur la disponibilité des mises à jour. Occasionellement, lorsque un grand nombre de mises à jour sont disponibles, cela peut prendre 10 minutes et plus pour s'achever.
- Yum ne semble pas fonctionner correctement. Que faire maintenant ?
Si, pour quelque raison, vous n'arrivez pas à faire fonctionner yum correctement, essayez :
yum clean metadata ou peut-être yum clean all --enablerepo=* puis yum update
- Résolution de 'Metadata file does not match checksum' (le fichier de métadata ne correspond pas à la somme de contrôle)
Message d'erreur typique
http://apt.sw.be/fedora/3/en/i386/dag/repodata/primary.xml.gz: [Errno -1] Metadata file does not match checksum Trying other mirror. Error: failure: repodata/primary.xml.gz from dag: [Errno 256] No more mirrors to try.
Pour nettoyer l'«up stream» des proxies, utilisez wget, exécutez :
wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/filelists.xml.gz wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/primary.xml.gz wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/repomd.xml yum update
- Solution pour 'Header is not complete'
Message d'erreur typique
---> Downloading header for php-mysql to pack into transaction set. php-mysql-4.3.9-3.22.15.i 100% |=========================| 37 kB 00:00 http://sme-mirror.firewall-services.com/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete. Trying other mirror.
Ceci est le plus souvent du aux pare-feux externes ; il y a des problèmes connus avec les dispositifs de Fortigate et Sonicwall. Essayer de désactiver le contrôle antivirus / anti logiciel espion.
- Un arrêt anormal lors d'une mise à jour du système peut le mettre dans un état où il est difficile de le récupérer.
Trouver tous les doublons de paquets rpm :
rpm -qa | sort | less
Ensuite, supprimer tous les doublons de rpm :
rpm -e --nodeps rpmname
Installez les rpms récents :
yum install rpmname signal-event post-upgrade; signal-event reboot
- Où puis-je aller pour en savoir plus sur yum, et sur la façon dont SME l'utilise ?
Adding_Software , manuel de yum, http://yum.baseurl.org/ http://linux.duke.edu/projects/yum/
Ajout, retrait ou désactivation des dépôts
- Quelle est la méthode recommandée pour ajouter d'autres dépôts pour yum ?
Le code suivant utilise le dépôt dag comme un exemple et met le statut à «désactivé». Le dépôt est configuré pour être utilisé en ligne de commande avec l'option --enablerepo= .
Voyez la page depôt dag en anglais.
- Comment puis-je supprimer des dépôts pour yum ?
db yum_repositories delete nom_du_depôt signal-event yum-modify
- Comment désactiver l'état d'un dépôt pour permettre une utilisation future en ligne de commande avec l'option --enablerepo= ?
db yum_repositories nom_du_depôt setprop status disabled signal-event yum-modify
Autres dépôts populaires
Une liste d'autres dépôts peut être trouvée à la page Category:Yum_Repository.
Soyez prudent en mettant à jour les logiciels à partir de ces dépôts. Faites les mises à jour par nom, par exemple.
yum update --enablerepo=nom_du_depôt nom_du_paquet
Ne pas faire une mise à jour généralisée en activant la 3ème partie (?, ndt) du dépôt parce que cela pourrait mettre à jour beaucoup de paquets qui remplaceraient les versions du serveur SME.
Comment faire une mise à jour complète et propre des contributions ?
Suivre ce fil : Comment mettre à jour le serveur SME complètement et proprement ?.
Supprimer un paquet logiciel
Si vous voulez retirer des paquets rpm en ligne de commande, utlisez :
rpm -e nom_du_paquet
«yum remove nom_du_paquet» fonctionnera si le paquet à retirer n'est pas essentiel, mais ce que vous considérez comme non essentiel peut différer de l'appréciation qu'en fait le système, il est donc préférable d'utiliser «rpm -e ...».
Liste de compatibilité matérielle
Liste des matériels connus pour avoir des problèmes avec le serveur SME.
Maintenir une liste de compatibilité matérielle est difficile, les liens suivants donneront une indication des matériels utilisés par les serveurs SME et leurs fournisseurs :
- https://hardware.redhat.com/index.cgi
- http://smolt.contribs.org (cette page est vide ?)
- http://wiki.centos.org/HardwareList
Postes client
- Prise en charge de Windows 7 par le Serveur SME 8. Voir Windows_7_Support
Actuellement le Serveur SME 8.x autorise ce client Windows à rejoindre le domaine du Serveur SME, soyez avisé que vous devez importer le correctif du registre qui peut être téléchargé à [1].
- Prise en charge de Windows 8 par le Serveur SME 8. Voir Windows_8_Support
Actuellement le Serveur SME 8.x autorise ce client Windows à rejoindre le domaine du Serveur SME, soyez avisé que vous devez importer le correctif du registre qui peut être téléchargé à [2].
Plus d'information est disponible ici pour Windows 7 et ici pour Windows 8.
- Windows 7 ne peut pas rejoindre le domaine de SME 7.x en raison de problèmes de relation de confiance. Cependant, vous pouvez configurer une mise à jour optionnelle non prise en charge si le support pour Windows 7 est critique pour votre environnement. Plus est disponible ici.
- Problèmes sur les fichiers hors ligne avec les clients Windows XP et Windows 7 ?
Configurer la clé de registre suivante sur le client Windows Vista ou Windows 7 pour empêcher les fichiers d'être à nouveau transférés sur le client immédiatement après les modifications de synchronisation sur le serveur (due à la résolution plus grande de l’horodatage des systèmes de fichiers sur Linux que sur Windows) :
Créer une valeur DWORD nommée RoundUpWriteTimeOnSync sous la HKLM\Software\Microsoft\Windows\CurrentVersion\NetCache clé (créer la clé si elle n'existe pas) et régler la à 1.
Plus d'information peut être trouvée ici : [3]
- Perte de connexion Samba ?
C'est un bogue possible lors d'une mise à jour à partir de SME6. Après une mise à jour, les postes locaux ne peuvent pas se connecter. Si vous rencontrez ce problème, jetez un œil, s'il vous plaît, à ce bogue correctif, et assurer le retour d'expérience : [4] Lien brisé : erreur 404.
- Clients Windows XP - Correctif pour ouvrir une session sur le domaine SME.
Ce correctif peut être utilisé quand des clients sous Windows XP clients ne peuvent pas ouvrir une session sur le domaine du Serveur SME. Le correctif du registre se trouve ici : http://servername/server-resources/regedit/winxplogon.reg Double clicker sur le fichier winxplogon.reg et les paramètres seront ajoutés au Registre Windows.
- Clients Windows XP - Erreur «le domaine n'est pas accessible»
Si l'ordinateur du client utilises un adaptateur LAN Gigabit, essayer [5].
- Le répertoire LDAP indique des erreurs MAPI_E_CALL_FAIL sur Outlook 2002 ou Outlook 2003
Sur Outlook 2002 ou 2003 quand quelqu'un essaye de trouver un contact en utilisant le serveur LDAP, un message indiquant «Extension critique non disponible» et puis un second message disant «La recherche ne peut aboutir. MAPI_E_CALL_FAIL» apparaît et la recherche ne retourne rien. Le répertoire fonctionne bien dans Thunderbird 1.5 comme dans Outlook 2000, mais pas dans 2002 ou 2003. Plus d'information peut être obtenue ici : [6] [7]
- Où est le répertoire de netlogon ?
Le répertoire de netlogon se trouve sur le Serveur SME à : /home/e-smith/files/samba/netlogon Il peut aussi être indiqué par l'ordinateur du client comme se trouvant à : \\servername\netlogon
Applications Web
- chmod 777
Utiser 777 est toujours une mauvaise chose (en dépit du fait que beaucoup de howtos le recommande). 0770 est suffisant, tant que www est un membre du groupe possédant le répertoire, et est plus sûr.
Utilisez chown www /path/to/dir
et mettez de préférence votre application dans /opt/app et non dans une ibay.
- Instructions génériques pour installer une application Web
- mod_perl n'a pas été installé dans les versions précédentes ? Comment puis-je l'installer ?
Il l'a peut-être été mais il n'a pas été utilisé de sorte qu'il n'est plus inclus. Si vous voulez l'installer, exécuter ce qui suit :
Note Les commandes dans un shell Linux sont sensibles à la casse, ce qui signifie que Capital n'est pas la même chose que capital.
yum install mod_perl config setprop modPerl status enabled signal-event post-upgrade ; signal-event reboot
- La structure du répertoire est visible. Comment puis-je désactiver les index dans les ibays ?
SME Server 6.0, 6.0.1, and 6.5 avaient tous l'option suivante dans le répertoire ibays/html : "Options Indexes Includes". Cela semble indiquer les index étaient autorisés pour les répertoire html. Dans le serveur SME 7.0, c'est devenu un paramètre et il est positionné à activé par défaut pour être compatible avec les versions du serveur SME antérieures aux installations du serveur SME Server 7.0.
Pour désactiver les index d'une ibay dans le serveur SME 7.0, exécutez :
db accounts setprop //ibayname// Indexes disabled signal-event ibay-modify //ibayname//
Cette question a initialement été soulevée ici : [[8]] lien cassé : erreur 404.
- Je dois créer (ou installer) une application PHP qui doit accéder au répertoire /tmp :
db accounts setprop ibayname PHPBaseDir /tmp/:/home/e-smith/files/ibays/ibayname/ signal-event ibay-modify ibayname
Par défaut, si vous avez du code PHP dans une IBAY, il ne peut fonctionner que dans cette IBAY. Les commandes ci-dessus permettront au code PHP de l'IBAY de s'exécuter à l'extérieur de son répertoire d'installation.
Voir une liste de tous les paramètres spécifiques de l'IBAY.
Réinitialiser le mot de passe root et admin
1. Redémarrer votre serveur et au début du démarrage, utilisez les touches des flèches pour sélectionner le noyau sur lequel vous aimeriez démarrer.
2. Presser la touche A, pour permettre d'ajouter des paramètres aux configurations du programme de démarrage grub.
3. Faire attention à ne rien changer, ajouter seulement ceci après le A (Soyez sûr de mettre un espace avant «single») :
single
4. Appuyer sur «Entrée». Un prompt apparaît.
5. A ce prompt, saisissez les deux commandes suivantes (séparée chacune par un retour chariot). Il vous sera demandé un nouveau mot de passe. Réinitialisez à la fois votre mot de passe «root» et celui d'«admin» et donnez-leur la même valeur :
passwd root passwd admin
6. Redémarrer votre serveur et maintenant tout doit fonctionner correctement.
Limitations de taille de fichier
- Apache : le serveur web peut seulement transférer ou montrer des fichiers de moins de 2G.
- Sauvegarde sur disque USB
FAT32 supporte seulement une taille de fichier inférieure à 4GB. Il est recommandé de formater les disques USB externes en ext3.
External DNS
Pour permettre aux usagers externe de communiquer avec votre serveur, vous devez avoir correctement configuré les enregistrements DNS. Une fois que vous avez acheté un domaine, vous devriez configurer les enregistrements suivants (à adapter si nécessaire) pour permettre la communication web et courriel :
1. Un enregistrement «A», monserveur.mondomaine.com, pointant sur l'adresse IP externe de votre serveur.
2. Un enregistrement «CNAME», *.mondomaine.com, pointant sur l'enregistrement «A» monserveur.mondomaine.com [qui est un attrape-tout qui permet aux alias comme www.mondomaine.com et mail.mondomaine.com d'être réésolu sans avoir à créer de multiples enregistrements «CNAME»].
3. Un enregistrement «MX», pointant sur monserveur.mondomaine.com, pour permettre la délivrance des courriels.
Si votre registraire ne vous permet pas de créer des enregistrements DNS, vous pouvez utiliser un service gratuit comme http://www.zoneedit.com ou similaire.
L’exemple indiqué suppose que votre serveur fonctionne en mode Serveur et Passerelle et possède une adresse IP externe statique. En fonction de votre réseau et de la configuration du serveur, l'exemple peut avoir besoin d'être modifié. Par exemple, si vous utilisez un service DNS dynamique, vous aurez besoin de modifier l'enregistrement «A» pour qu'il pointe sur votre hôte DNS dynamique, plutôt que sur une adresse IP statique.
Domaines
- Quand je crée un DOMAINE, je ne vois rien d'écrit sur le panneau des NOMS D'HÔTE et des ADRESSES pour ce DOMAINE.
Pour qu'un domaine soit effectif (pour les courriels ou le web), il a besoin d'être configuré en tant que SERVEURS DNS INTERNET (c'est la valeur par défaut). Puisque le domaine se résout via les SERVEURS DNS INTERNET, ni noms de domaines, ni adresses ne sont créés localement. Pour plus d'information, visiter, s.v.p., le Manuel d'Administration, section concernant les Domaines : [[9]]
DNS délégué
SME permet 3 réglages pour la résolution DNS d'un nom de domaine :
- résolution locale ;
- serveurs DNS d'Internet ;
- serveurs DNS de l'entreprise.
Si ce n'est pas suffisant, vous pouvez les étendre pour des domaines individuels sur votre Serveur SME (en transférant toutes les requêtes DNS pour le domaine spécifié à un autre serveur) comme suit :
- en premier, créer les domaines virtuels nécessaires en utilisant le gestionnaire du serveur::Configuration::Domaines::Ajouter un domaine ;
- puis, (en supposant que votre domaine s'appelle test.com et que le serveur DNS actuel est à l'adresse IP a.b.c.d, exécutez les commandes suivantes :
db domains setprop test.com Nameservers a.b.c.d signal-event domain-modify
Vérifiez avec :
cat /var/service/dnscache/root/servers/test.com
Transfert de DNS
Le service «dnscache» peut être configuré pour transférer toutes les requêtes pour un domaine specifique à un serveur alternatif utilisant le type d'enregistrement «domain-remote» dans la db des domaines. Ce peut être utilisé pour diriger DNS pour un domaine vers un serveur DNS interne connecté à votre réseau en utilisant un VPN ou un itinéraire personalisé, ou pour diriger votre DNS active directory local (?, ndt) vers votre serveur Active Directory, etc.
Pour transférer tous les DNS pour <nom_de_domaine> vers un serveur DNS distant spécifié (4.2.2.1 dans cet exemple) :
db domains set <nom_de_domaine> domain-remote Nameservers 4.2.2.1 signal-event domain-modify
En tant qu'effet secondaire, vous pouvez bloquer DNS pour un domaine en configurant le transfert DNS vers 'localhost'.
Cette commande dit à votre Serveur SME de faire toutes les recherches DNS de <nom_de_domaine> localement, mais ne configure aucune entrée DNS correspondante. Les recherches tentées pour le domaine et tous les sous-domaines échoueront :
db domains set <nom_de_domaine> domain-remote Nameservers localhost signal-event domain-modify
- Les entrées 'domain-remote' n'apparaissent pas dans le gestionnaire du serveur ; elles peuvent être gérées uniquement en ligne de commande.
- «Nameservers» peut être une liste de noms de serveurs ou d'adresses IP, séparés par des virgules.
Recherche de virus
- Lorsque vous choisissez d'analyser votre serveur chaque nuit à la recherche de virus, la commande par défaut est d'analyser le répertoire /home/e-smith/files.
Notez que les premiers Serveurs SME 7 étaient par défaut sur /.
Aussi vous voudrez peut-être analyser le répertoire /opt s'il contient des contributions qui y rangent les données des utilisateurs.
La propriété db pour changer la valeur par défaut :
config setprop clamav FilesystemScanFilesystems /home/e-smith/files
ou pour scanner différentes zones du serveur :
config setprop clamav FilesystemScanFilesystems "/home/e-smith/files /opt"
- Comment exclure certains répertoires de l'analyse
Définir la valeur db pour exclure d'autres répertoires
Par défaut
config setprop clamav FilesystemScanExclude /proc,/sys,/usr/share,/var
Changer par
config setprop clamav FilesystemScanExclude /proc,/sys,/usr/share,/var,/home/e-smith/files/ibays
Après toute modification, exécuter «signal-event» pour développer et régénérer les fichiers de configuration, et redémarrer les services pertinents.
signal-event clamav-update
Proxy Pass
ProxyPass un domaine
Cette section traite des directives ProxyPass dans la base de données «domaines».
- Je veux rediriger des requêtes http vers un serveur derrière mon Serveur SME ou externe à mon site, comment puis-je faire cela ?
Vous pouvez créer une directive ProxyPass qui renverra certaines requêtes vers un serveur interne ou externe au domaine qui doit être le relais :
db domains set proxypassdomaine.com domain db domains setprop proxypassdomaine.com Nameservers internet db domains setprop proxypassdomaine.com ProxyPassTarget http://xxx.xxx.xxx.xxx/ db domains setprop proxypassdomaine.com TemplatePath ProxyPassVirtualHosts signal-event domain-create proxypassdomaine.com
Ou proxypassdomaine.com est le nom de domaine supportant le serveur interne ou externe et http://xxx.xxx.xxx.xxx/ est l'adresse IP interne ou externe du serveur par exemple 192.168.1.20 ou 122.456.12.171 (cela doit être l'adresse IP publiquement accessible dans le cas d'un serveur externe).
Pour effacer une directive ProxyPass qui a été précédemment mise en place :
db domains delete proxypassdomaine.com signal-event domain-delete proxypassdomaine.com
Se référer aussi à ces liens pour de l'information concernant la fonctionnalité du domaine virtuel proxypass du Serveur SME, à partir de ce fil http://forums.contribs.org/index.php/topic,47795.0.html
http://bugs.contribs.org/show_bug.cgi?id=999
http://forums.contribs.org/index.php?topic=47160.0
http://forums.contribs.org/index.php?topic=46975.0
A partir de ce message de Charlie Brady sur le forum http://forums.contribs.org/index.php/topic,49181.msg245408.html#msg245408, il y a de l'information sur les accès https et le comportement attendu des certificats.
Ce qui se passe, c'est que le fureteur se connecte au Serveur SME, puis négocie une connexion SSL (vérifie le certificat et commence à crypter la connexion ), puis envoie la requête (nom d'hôte + URL). Puis Apache dans le Serveur SME établit la connexion (crée la connexion au serveur web interne, passe la requête, renvoie la réponse). Il n'est pas possible que le certificat du serveur interne puisse être présenté au fureteur et utilisé pour activer le cryptage.
ProxyPass un alias/répertoire/emplacement
Cette section traite des paramètres db dans la base de données «comptes» qui génèrent les directives ProxyPass dans httpd.conf.
- J'ai un domaine http://mondomain.com et je voudrais que http://mondomain.com/extra redirige vers le serveur interne. Comment puis-je utiliser les directives du compte db ?
Vous pouvez faire ce que vous voulez en créant un fragment de modèle personnalisé qui active proxypass sur «... /extra» ; les notes de cette discussion du forum http://forums.contribs.org/index.php/topic-40075.0.html devraient aider.
Les travaux suivants sur les systèmes SME 7.5.1 et SME 8beta6 où le fragment de modèle /etc/e-smith/templates/etc/httpd/conf/httpd.conf/35ProxyPass contient le code approprié qui est généré automatiquement en émettant les commandes db suivantes :
db accounts set extra ProxyPass db accounts setprop extra Target http://192.168.1.35 db accounts setprop extra Description InternalServer db accounts setprop extra HTTP on db accounts setprop extra HTTPS on db accounts setprop extra ValidFrom 80.90.100.0/24,74.125.93.105 expand-template /etc/httpd/conf/httpd.conf sv t httpd-e-smith
Voir ces message sur le forum :
http://forums.contribs.org/index.php/topic,47741.msg236017.html#msg236017
http://forums.contribs.org/index.php/topic,40075.0.html
ProxyPass pour Outlook Exchange Web Access
Les utilisateurs souhaitant implémenter cette configuration sont fortement invités à lire en entier ce fil du forum http://forums.contribs.org/index.php/topic,40075.0.html à partir duquel les informations suivantes ont été obtenues.
- Comment puis-je configurer l'accès d'Outlook Web Access (OWA) à un serveur Exchange 2003 interne ?
Exécuter les commande suivantes (remplacer «a.b.c.d» par l'IP LAN de votre serveur Exchange) :
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
cd /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
echo '# ProxyPass Support for Internal Exchange Server
ProxyPreserveHost On
#OWA % character in email subject fix
RewriteEngine On
RewriteMap percentsubject int:escape
RewriteCond $1 ^/exchange/.*\%.*$
RewriteRule (/exchange/.*) ${percentsubject:$1} [P]
#OWA
ProxyPass /exchange https://a.b.c.d/exchange
ProxyPassReverse /exchange https://a.b.c.d/exchange
ProxyPass /Exchange https://a.b.c.d/exchange
ProxyPassReverse /Exchange https://a.b.c.d/exchange
ProxyPass /exchweb https://a.b.c.d/exchweb
ProxyPassReverse /exchweb https://a.b.c.d/exchweb
ProxyPass /public https://a.b.c.d/public
ProxyPassReverse /public https://a.b.c.d/public
ProxyPass /iisadmpwd https://a.b.c.d/iisadmpwd
ProxyPassReverse /iisadmpwd https://a.b.c.d/iisadmpwd
#OMA
ProxyPass /oma https://a.b.c.d/oma
ProxyPassReverse /oma https://a.b.c.d/oma
#ActiveSync (for WM5+ devices)
ProxyPass /Microsoft-Server-ActiveSync https://a.b.c.d/Microsoft-Server-ActiveSync
ProxyPassReverse /Microsoft-Server-ActiveSync https://a.b.c.d/Microsoft-Server-ActiveSync
#Force 'RequestHeader' in order to get IE to work
# End of Exchange settings
' > 91ProxyPassOWA
expand-template /etc/httpd/conf/httpd.conf
sv restart httpd-e-smith
Il est alors possible de se connecter à OWA à https://any.sme.domainname.com/exchange à partir de Firefox (et probablement d'Opera ou de Safari), mais pas de connexion en utilisant IE7.
Pour vous connecter à partir d'Internet Explorer, il est nécessaire de désactiver l'«authentification Windows Intégrée» dans IIS sur le serveur Exchange comme suit :
- démarrer le Gestionnaire des Services Internet (IIS) sur le serveur Exchange ;
- ouvrir Sites Web ;
- ouvrir le Site Web par défaut ;
- cliquer avec le bouton droit sur Exchange et sélectionner «Propriétés» ;
- cliquer sur l'onglet Sécurité des Répertoires ;
- cliquer sur le bouton de modification d'«Authentification et contrôle d'accès» ;
- supprimer la coche d'«authentification Windows Intégrée» ;
- cliquer sur «OK» ;
- cliquer de nouveau sur «OK».
Remarque : aucun redémarrage n'est nécessaire sur le serveur Exchange - dès que les modifications ci-dessus sont effectuées, il est possible de se connecter avec succès à l'aide d'Internet Explorer.
- Références et plus d'information :
Les informations ci-dessus sont essentiellement fondées sur ce fil :
http://systembash.com/content/outlook-web-access-apache-proxy/
Remarque : la directive «RequestHeader» décrite ici n'était pas nécessaire lorsqu'elle était testée sur un système SME 7.2.
Voici une adresse qui contient des informations sur Exchange 2007 :
http://www.utahsysadmin.com/2007/12/20/apache-reverseproxy-for-owa/
Voici les documentations Apache pour mod_proxy et mod_headers :
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypass
http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#proxypass
http://httpd.apache.org/docs/2.0/mod/mod_headers.html
- Commentaires des utilisateurs et informations supplémentaires sur la méthode ci-dessus :
Cette méthode fonctionne bien, sauf qu'il était nécessaire d'ajouter une ligne ou deux pour créer /owa qui est le répertoire attendu pour que OWA s'exécute. Il fonctionne avec tous les domaines hébergés sur le serveur SME 7.4 utilisé. Pour le limiter à un domaine résolu publiquement, cela a été résolu comme suit.
Cela s'applique à un Serveur SME 7.4 avec plus d'un hôte virtuel qui a le FQDN accessible publiquement. Pour ce faire, le Serveur SME (et tous les autres serveurs) a été configuré avec un domaine fictif comme private.local et tout ce qui se trouve dans la configuration du réseau de sorte qu'il ne soit pas routable de l'extérieur. Dans ce scénario, seul le Serveur SME est accessible publiquement (et derrière un routeur WAG54GP2 avec les ports 80, 443 ouverts). En utilisant DYNDNS.ORG, un compte a été créé et deux domaines ont été achetés :
domaineA.com
domaineB.co.nz
Utiliser l'administrateur DynDNS pour configurer les cnames comme suit :
www.domaineA.com -> domaineA.com
remote.domaineA.com -> domaineA.com
www.domaineB -> domaineB.co.nz
Notez également que DynDNS ne vend pas les domaines co.nz, ceux-ci ont été achetés à partir de domainz.com et pointé le DNS sur les serveurs DNS DynDNS. En fin de compte, tous les hôtes pointent vers l'adresse IP statique obtenue à partir de World Exchange pour un supplément de 20 $. Dans cette situation le DNS dynamique n'est pas utilisé, mais le compte DynDNS existait, et il a fourni les DNS redondants, il était donc facile à conserver.
Le Serveur SME a été installé avec des additifs comme Wordpress, etc. dans chaque baie d'information (ibay) comme exigé pour que www.domaineA.com et www.domaineB.co.nz aillent à différents blogues de Wordpress par défaut (se référer à la FAQ sur contribs.org et les instructions sur wordpress.org pour configurer Wordpress dans une baie d'information).
Sur le LAN et sur une adresse (non-routable) en 192.168.*.*, il y a un serveur Exchange.
Les exigences étaient d'avoir le composant OWA disponible à partir de l'extérieur du réseau local et d'une page Web «bureau à domicile».
Rendant la mise en œuvre un peu plus difficile, l'exigence était pour www.domaineA.com d'aller à la baie de SME et pour homeoffice.domaineA.com d'aller au serveur Windows - iis.private.local et d'avoir iis.private.local/owa qui fonctionnent correctement.
C'est pour que le serveur IIS et Exchange puisse être «caché» derrière Apache, et qu'un seul certificat soit obtenu et utilisé.
Pour ce faire, Apache doit tout résoudre pour les baies, sauf l'hôte virtuel et ses répertoires /owa.
1. Activer SSLProxy :
Créez un fichier /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/35SSLProxyEngine contenant uniquement les mots «SSLProxyEngine on» sur une seule ligne, sans guillemets.
2. En utilisant cette info de threads comme ci-dessus, sauf, inclure une directive «VirtualHosts» pour le domaine distant :
Créer un fichier /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/76ProxyPass
Qui ressemble à ceci :
# Trasnfert de remote.domaineA.com vers iis.private.local <VirtualHost 0.0.0.0:80> ServerName remote.domaineA.com ProxyPass / http://iis.private.local/ ProxyPassReverse / http://iis.private.local/ </VirtualHost> <VirtualHost 0.0.0.0:443> ServerName remote.domaineA.com ProxyPass / https://iis.private.local/ ProxyPassReverse / https://iis.private.local/ # Preserve meta info in the http line as a resolvable request ProxyPreserveHost On #OWA % caractère dans la correction de l'objet de courriel RewriteEngine On RewriteMap percentsubject int:escape RewriteCond $1 ^/exchange/.*\%.*$ RewriteRule (/exchange/.*) ${percentsubject:$1} [P] #OWA ProxyPass /exchange https://iis.private.local/exchange ProxyPassReverse /exchange https://iis.private.local/exchange ProxyPass /owa https://iis.private.local/owa ProxyPassReverse /owa https://iis.private.local/owa ProxyPass /Exchange https://iis.private.local/exchange ProxyPassReverse /Exchange https://iis.private.local/exchange ProxyPass /exchweb https://iis.private.local/exchweb ProxyPassReverse /exchweb https://iis.private.local/exchweb ProxyPass /public https://iis.private.local/public ProxyPassReverse /public https://iis.private.local/public ProxyPass /iisadmpwd https://iis.private.local/iisadmpwd ProxyPassReverse /iisadmpwd https://iis.private.local/iisadmpwd #OMA ProxyPass /oma https://iis.private.local/oma ProxyPassReverse /oma https://iis.private.local/oma #ActiveSync (pour les périphériques WM5+) ProxyPass /Microsoft-Server-ActiveSync https://iis.private.local/Microsoft-Server-ActiveSync ProxyPassReverse /Microsoft-Server-ActiveSync https://iis.private.local/Microsoft-Server-ActiveSync # Fin des paramétrages d'Exchange </VirtualHost>
où iis.private.local est l'instance privée de IIS. Et remote.domaineA.com Et remote.domainA.com est un domaine publiquement adressable qui résout le côté public du serveur SME. Pour être sûr que cela fonctionne, vous devez être capable de résoudre iis.private.local à partir du serveur SME (ajoutez un enregistrement «hostname» avec l'adresse IP interne correcte). Assurez-vous que l'authentification intégrée est désactivée pour OWA (laissez l'authentification de base activée).
3. Développer le modèle et redémarrer le serveur Web SME :
expand-template /etc/httpd/conf/httpd.conf sv restart httpd-e-smith
Essai :
D'un autre ordinateur externe à un autre endroit ou d'un café Internet, aller à http://www.domaineA.com, cela devrait aller sur le serveur Wordpress comme cela été installé.
http://www.domaineB.com devrait aller à cet autre serveur Wordpress comme installé. Si vous accédez à n'importe quel site https, cela devrait également donner un certificat et ouvrir le serveur Wordpress correspondant tel qu'il a été configuré.
Si vous accédez à http://remote.domaineA.com ou https://remote.domaineA.com, cela devrait aller au serveur d'IIS et à aucune autre adresse (ceci par exemple vous permettra de vendre l'hébergement sans la possibilité pour les clients d'accéder au serveur IIS). L'étape suivante consiste à créer une page par défaut sur IIS qui contienne des informations utiles pour le propre bureau à domicile et inclut des liens vers le webmail pour les personnes qui ne peuvent pas se souvenir des URL longues ou confuses, etc.
Autres ressources utiles :
- http://bugs.contribs.org/show_bug.cgi?id=1612
- les documents Apache
Accès au shell
- Je dois donner à un utilisateur un accès au shell du serveur SME.
L'accès au shell ne doit être fourni qu'aux utilisateurs qui en ont besoin et auxquels on peut faire confiance.
Avant qu'un utilisateur puisse avoir un accès au shell, l'Admin doit activer l'accès ssh :
Gestionnaire du serveur -> Sécurité -> Accès à distance
Vous activez ensuite l'accès au shell pour un utilisateur par :
db accounts setprop nom_de_l_utilisateur Shell /bin/bash chsh -s /bin/bash nom_de_l_utilisateur
Mise à niveau du serveur
- Quelle est la meilleure façon de changer de version vers un nouveau serveur ?
Un article est écrit pour ce sujet en anglais. Veuillez visiter : UpgradeDisk.
- Voulez-vous déplacer une installation en fonctionnement du serveur SME 8 vers un nouveau matériel ?
Il existe un document qui décrit une méthode utilisant la contribution Affa (smeserver-affa précisément). Affa permet de déplacer avec un effort minimal et un temps d'arrêt minimal du serveur de production. Veuillez visiter : Déplacement d'un serveur SME vers un nouveau matériel.
Changer la longueur maximale du nom d'une baie d'information, d'un compte ou d'un groupe
- Comment changer la longueur maximale par défaut (12 caractères) d'une baie d'information, d'un compte ou d'un groupe ?
Entrer la commande suivante en console en tant que «root» :
/sbin/e-smith/db configuration set maxIbayNameLength xx /sbin/e-smith/db configuration set maxAcctNameLength xx /sbin/e-smith/db configuration set maxGroupNameLength xx
où 'xx' est la nouvelle taille, par exemple 15.
Suivi de :
/sbin/e-smith/signal-event console-save
Suppression d'utilisateurs, de baies d'information, de groupes - Junkmail
- Je ne peux pas supprimer et créer un utilisateur pour une raison quelconque. Que dois-je faire maintenant ?
Si, pour une raison quelconque, vous ne pouvez pas supprimer et créer un utilisateur, faites d'abord :
signal-event user-delete <nom_utilisateur> db accounts delete <nom_utilisateur>
- Je ne peux pas supprimer et créer une baie d'information (Ibay) pour une raison quelconque. Que dois-je faire maintenant ?
Si, pour une raison quelconque, vous ne pouvez pas supprimer et créer une baie d'information, faites d'abord :
signal-event ibay-delete <nom_baie> db accounts delete <nom_baie>
- Je ne peux pas supprimer et créer un groupe pour une raison quelconque. Que dois-je faire maintenant ?
Si, pour une raison quelconque, vous ne pouvez pas supprimer et créer un groupe, faites d'abord :
signal-event group-delete <nom_groupe> db accounts delete <nom_groupe>
- Je cherchais dans le répertoire d'un utilisateur et je vois un répertoire caché appelé «.junkmail». Ai-je besoin de cela ? Puis-je le supprimer ?
Ne supprimez, ni renommez les dossiers .junkmail.
Accès refusé à la baie d'information avec le groupe créé récemment
- Problème : si je tente d'écrire sur une baie immédiatement après la création d'un nouveau groupe, et en tant que membre de ce groupe, et l'attribution des droits d'accès du groupe à la baie, l'accès est refusé. Si la modification de l'accès à la baie concerne un groupe plus ancien dont je suis membre, l'accès est autorisé comme demandé.
Solution : se déconnecter après la création du groupe et puis se reconnecter.
Le problème semble être lié à samba, non à SME. Voir bugzilla: 4961. Les droits sont attribués lors de l'ouverture de la session sous Linux, d'où la nécessité de se déconnecter puis de se reconnecter pour recevoir les droits du groupe nouvellement créé.
Changer le mot de passe utilisateur en ligne de commande
Si vous voulez changer le mot de passe de vos utilisateurs en ligne de commande au lieu du menu «Utilisateurs» du gestionnaire du serveur SME, vous pouvez le faire comme ça. Pour un grand nombre de changements, vous devriez chercher une contribution nommée lazy_admin_tools.
perl -e "use esmith::util;esmith::util::setUserPassword( 'username', 'password');"; /sbin/e-smith/signal-event password-modify username
l'exécuter pour chaque utilisateur séparément et remplacer
«username»
et
«password»
avec les valeurs appropriées pour chacun de vos utilisateurs.
Vérification de la force du mot de passe
- Comment puis-je changer la force du mot de passe et qu'entend-on par paramètres de force ?
Les paramètres suivants sont disponibles pour indiquer la force du mot de passe sur le serveur SME :
| paramètre explication | - | strong | Forte : le mot de passe est passé à travers Cracklib pour la vérification des mots du dictionnaire ainsi que l'exigence de majuscules, minuscules, d'un chiffre, d'un caractère non alphanumérique et d'une longueur mimimum de 7 caractères. | - | normal | Le mot de passe nécessite des majuscules, minuscules, un chiffre, un caractère non alphanumérique et une longueur minimale de 7 caractères. | - | none | Le mot de passe peut être n'importe quoi et aucune vérification est faite.
Noter, s.v.p., que «none» ne veut pas dire aucun mot de passe, cela signifie simplement que la force de mot de passe n'est pas contrôlée, de sorte que vous pouvez entrer n'importe quel (faible) mot de passe que vous voulez dès lors qu'il a au moins sept caractères. |
|---|
Pour définir la force du mot de passe faire :
config setprop passwordstrength Admin strengthvalue config setprop passwordstrength Users strengthvalue config setprop passwordstrength Ibays strengthvalue
où «strengthvalue» est l'une des valeurs indiquée dans le tableau ci-dessus ; soit «strong», «normal» ou «none».
par exemple :
config setprop passwordstrength Users normal
Pour passer en revue les paramètres actuels, faire :
config show passwordstrength
qui devrait afficher quelque chose comme :
passwordstrength=configuration Admin=strong Ibays=strong Users=strong
Alternativement, vous pouvez installer la contribution «smeserver-password» débattue ici : Password.
Cette contribution vous permettra de configurer la force du mot de passe et sa durée de vie à travers un menu du gestionnaire du serveur.
References:
Disques durs, RAID, disques durs USB
- Comment dois-je configurer mes disques durs ?
Nous ne recommandons jamais rien d'autre qu'une installation d'un seul disque ou de plusieurs disques du même type. Pour toute autre configuration, vous êtes dans une configuration non recommandée et vous aurez besoin de la gérer vous-même. Nous répétons que nous ne recommandons jamais rien d'autre qu'une installation d'un seul disque ou de plusieurs disques du même type. Si vous envisagez de faire autre chose (configurer vos propres partitions), lisez à nouveau cette section.
- Comment dois-je configurer mon RAID ?
Un article complet sur le RAID se trouve ici : Raid.
- Je veux utiliser un RAID matériel. Que proposez-vous ?
Voir, s.v.p., les notes dans l'article sur le RAID : Raid#Raid_Notes.
- Comment puis-je récupérer un serveur SME avec des disques LVM ?
Un article complet sur la méthode de récupération se trouve ici : Recovering_SME_Server_with_lvm_drives.
- J'installe RAID 5, mais cela semble prendre beaucoup de temps. Y a-t-il une erreur ?
Les systèmes RAID 5 (ceux avec 3 disques et plus) peuvent prendre beaucoup de temps pendant et après l'installation pour tout synchroniser. Selon certaines sources, il faut près de deux heures avant que les disques finissent enfin la synchronisation de 4 disques de 80 Gb.
- Si je démarre mon serveur SME avec un disque dur connecté en USB, il reconnaît le lecteur. Cependant, après avoir débranché le lecteur, puis rebranché, il n'est plus reconnu. Avez-vous une idée de la cause ?
Selon les témoignages, certains disques durs USB externes doivent être mis sous tension avant de connecter le câble USB.
- Si je démarre mon serveur SME avec un disque dur USB connecté, il ne reconnaît pas le lecteur. Quelles sont les solutions pour contourner cela ?
Certains lecteurs USB doivent être branchés deux fois sur le serveur pour être reconnus.
- Plus d'informations en ce qui concerne les disques USB peuvent être trouvées dans ce tutoriel : USBDisks.
Sauvegardes & restaurations
- AIT-1 Sauvegarde : buffer douteux
Un AIT-1 est douteuse si elle est utilisée avec la taille de bloc variable. Régler le paramaètre :
config setprop flexbackup TapeBlocksize 512
AIT-2, DAT et LTO semblent bien fonctionner avec la taille de bloc variable..
- Les performances de sauvegarde sur bande lente peuvent être améliorées en changeant les paramètres de sauvegarde Flex
config setprop flexbackup Blocksize 256 config setprop flexbackup BufferMegs 16
- Dans la console de l'administrateur, il y a une option pour SAUVEGARDER SUR USB mais il n'y a pas d'options de restauration.
L'option RESTAURATION est uniquement visible sur une nouvelle installation. Si vous l'avez ratée durant l'installation, vous pouvez :
config set PasswordSet no signal-event post-upgrade; signal-event reboot
Pendant le processus de reconfiguration de redémarrage, vous devriez voir la nouvelle restauration via l'option de sauvegarde USB.
-MAINTENANT branchez la clé USB (ne pas brancher la clé USB avant d’atteindre ce point). -choisir OUI ou RESTAURER (ou n'importe quoi d'autre qui est présenté).
Les services supervisés
- De nombreux services sont supervisés sur SME, pour voir ceux qui le sont, saisir :
ps ax | grep runsv
Pour les contrôler, lire le manuel sv :
man sv
- Il semble que «sv u http-e-smith» ne retourne aucune erreur, même si le service ne parvient pas à redémarrer, vous devez donc utiliser «sv s httpd-e-smith» pour vérifier si elle échoue (par exemple : du à une erreur de httpd.conf).
Ceci est juste la façon dont runsv (partie du paquet runit) fonctionne. «sv u http-e-smith» envoie seulement un message à runsv disant que nous voulons que le service démarre. «runsv» continuera ensuite à essayer d'obtenir le démarrage du service.
Gestionnaire du serveur
- Je ne peux pas accéder au gestionnaire du serveur. Que dois-je faire maintenant ?
Il y a beaucoup de causes qui peuvent vous empêcher d'accéder au gestionnaire du serveur. En premier lieu, essayer :
signal-event post-upgrade; signal-event reboot
Si vous ne pouvez toujours pas accéder, il y a des retours qu'une désadaptation des certificats pourrait s'être produite après la mise à jour. Dans ce cas :
rm /home/e-smith/ssl.key/*.key rm /home/e-smith/ssl.pem/*.pem rm /home/e-smith/ssl.crt/*.crt signal-event domain-modify; signal-event reboot
- J'avais l'habitude d'accéder au GESTIONNAIRE DU SERVEUR avec localhost:980 à distance via un tunnel SSH et maintenant je ne peux plus. Que s'est-il passé ?
Cette fonctionnalité a été longtemps obsolète et a finalement été retirée dans la version 7.2.
Si vous voulez vraiment utiliser ceci, renvoyer 443 sur localhost:443 :
ssh -L 443:localhost:443 root@ip-sme-or-hostname-sm
et puis utilisez : https://localhost/server-manager/
- Accès avec des ports non standards
Dans certains cas où vous n’êtes pas «root» sur l'ordinateur local, vous ne pouvez pas rediriger un port inférieur à 1024, donc vous devez utiliser un port supérieur à 1024 comme dans l'exemple suivant.
ssh -L 9443:localhost:443 root@votre-ip-distante -p 22
où : 9443 est le port local ; 443 est le port https distant ; votre-ip-distante est l'hôte distant (peut être une IP ou un nom de domaine) ; 22 est le port écouté par le serveur ssh, vous pouvez le changer en accord avec le serveur distant.
Laissez le terminal ouvert, ensuite vous devez utiliser cette URL spécifique dans votre fureteur Internet pour accéder au gestionnaire du serveur.
https://localhost:9443/server-manager
- En utilisant un client ssh, l'écran de connexion du gestionnaire du serveur est difficile à lire.
Le texte est blanc, donc vous devez ajuster votre client ssh pour utiliser un fond noir.
- J'ai renommé mon serveur avec la CONSOLE ADMIN. L'ancien nom apparaît dans le gestionnaire du serveur, panneau NOMS D'HÔTES. Il ne peut pas être effacé car il n'y a pas de liens MODIFIER/CHANGER.
- Se connecter en ligne de commande ; saisir :
db hosts setprop <local.ma societe.local> static no
- aller au panneau NOMS D'HÔTES & ADRESSES et vous pourrez modifier/changer le nom.
Booting with SMP kernel after upgrade to version 7.2 from CD
- I've upgraded and now the SMP kernel isn't available.
This is because when upgrading to 7.2 from CD, kernel modules are missing for SMP IF the output of "cat/proc/cpuinfo" does not show multiple processors. The SMP kernel, if not present, can be installed via yum using: Do:
yum install kernel-smp kmod-ppp-smp kmod-slip-smp kmod-appletalk-smp signal-event post-upgrade signal-event reboot
Details: http://bugs.contribs.org/show_bug.cgi?id=3095
- I'm getting a kernel panic after upgrade from CD. What do I do now?
When upgrading with a CD, the upgrade will rewrite the grub.conf file. As a result, any additional boot arguments (i.e. acpi=off) will be lost during upgrade. Please edit the grub.conf file.
Caractères speciaux
- Je vois des caractères et des lettres étranges lorsque je regarde mes noms de fichiers.
Si vous obtenez des noms de fichiers qui ressemblent à : "à © èÃ.txt", c'est probablement parce que le serveur SME ne comprend pas les caractères spéciaux que vous pouvez utiliser. Vous pouvez le modifier pour qu'il comprenne les caractères spéciaux des noms de fichiers par :
db configuration setprop smb UnixCharSet ISO8859-1 expand-template /etc/smb.conf /etc/init.d/smb restart
Configuration du serveur proxy en amont
Le serveur SME vous permet du trafic Internet proxy pour les différents composants à travers un serveur proxy «en amont».
Vous devrez peut-être faire ceci si :
- votre serveur SME n'a pas d'accès direct à Internet ;
- vous disposez de plusieurs sites et avez besoin d'un contrôle centralisé de l'activité sur Internet et de rapports ;
- vous devez imposer des restrictions d'accès à Internet à vos utilisateurs (dans une école, par exemple).
- Comment configurer un serveur proxy en amont mandataire, il y avait un panneau dans les versions antérieures du serveur SME, mais il est manquant dans SME 7.x.
config set SquidParent a.b.c.d config set SquidParentPort nnn signal-event post-upgrade signal-event reboot
[Le réglage SquidParentPort est optionnel si le proxy en amont est sur le port 3128.]
A partir de ce fil http://forums.contribs.org/index.php?topic=32998.msg140512#msg140512
Yum (mises à jour du système)
Comment puis-je faire des mises à jour avec yum au travers d'un serveur proxy (dans le cas où mon serveur SME n'a pas d'accès Internet direct) ?
Fondé sur Bugzilla:2407 :
mkdir -p /etc/e-smith/templates-custom/etc/yum.conf
cd /etc/e-smith/templates-custom/etc/yum.conf
echo '{
my $YumProxy = $yum{'Proxy'} || "none";
$OUT = ($YumProxy eq "none") ? "" : "proxy=$YumProxy";
}' > 10main_proxy
config setprop yum Proxy http://localhost:3128/
expand-template /etc/yum.conf
- Le code décrit ci-dessus devrait fonctionner (non testé) si vous avez configuré SquidParent pour votre serveur.
- Vous pouvez (alternativement) remplacer http://localhost:3128 par l'adresse de votre proxy en amont.
ClamAv / freshclam
Comment dois-je configurer freshclam pour télécharger des mises à jour pour ClamAV à travers un serveur proxy ?
Fondé sur l'examen de /etc/e-smith/templates/etc/freshclam.conf/ProxySettings:
config setprop clamav HTTPProxyServer localhost config setprop clamav HTTPProxyPort 3128 config setprop clamav HTTPProxyUsername "" config setprop clamav HTTPProxyPassword "" expand-template /etc/freshclam.conf sv t freshclam
- Le code affiché permettra les mises à jour de ClamAV à travers votre proxy squid local.
- Vous pouvez (alternativement) remplacer les valeurs montrés ci-dessus par les valeurs nécessaires pour n'importe quel proxy en amont.
Bugzilla:542.
Spamassassin
A partir de http://wiki.apache.org/spamassassin/RuleUpdates :
Que faire si j'ai besoin de mises à jour pour passer au travers d'un serveur proxy ?
sa-update utilise le module LWP::UserAgent, qui permet de définir certaines variables d'environnement de sorte que les requêtes utilisent des serveurs proxy définis. Le plus intéressant est "http_proxy", qui devrait être paramétré vers une URL définissant le proxy. C'est-à-dire : export http_proxy='http://proxy.example.com:8080/'
Sur un serveur SME, cela devrait fonctionner avec export http_proxy='http://localhost:3128', qui nécessiterait d'être ajouté à /etc/cron.daily/sa_update
curl, wget
Pour que «curl» et «wget» fonctionnent correctement sur un serveur SME sans accès Internet direct, vous devez au préalable exécuter la commande suivante dans le même programme ou dans la même session en ligne de commande :
export http_proxy=localhost:3128
Exemple :
export http_proxy=localhost:3128 curl http://www.google.com
ssh, ftp, telnet
Essai et vérification
Vous pouvez vérifier qu'un programme particulier est transmis par proxy au travers de squid à votre serveur local SME en recherchant /var/log/squid/access.log pour accéder à l'adresse Web cible provenant de '127.0.0.1'.
C'est-à-dire, après l'exécution de ces commandes :
export http_proxy=localhost:3128 curl http://www.google.com
Vous devriez voir une entrée similaire à la suivante /var/log/squid/access.log:
1329759611.923 64 127.0.0.1 TCP_MISS/301 726 GET http://www.google.com - DIRECT/74.125.113.94 text/html
Utilisation de la mémoire et limites
- Combien de mémoire peut gérer le serveur SME ?
Le serveur SME actuel (v7.3) prend en charge 16 Go de RAM, avec un maximum de 3 Go par processus. Ces limites peuvent facilement être augmentées à 64 Go au total et 4 Go par processus en installant et en exécutant la variante «hugemem» du noyau.
- Pourquoi mon serveur SME semble toujours utiliser toute la mémoire ? Il n'y a plus de mémoire disponible.
Les utilitaires tels que top ou htop indiquent toujours que toute la mémoire disponible est utilisée. Le système d'exploitation Linux est conçu pour utiliser toute la mémoire disponible tout le temps. Si d'autres processus nécessitent plus de mémoire alors elle est mise à la disposition de ces processus. Utiliser pleinement toute la mémoire disponible est une bonne chose car elle optimise la performance de votre serveur.
- Comment puis-je savoir si mon serveur SME a besoin de plus de mémoire ?
Regardez l'utilisation de la mémoire d'échange (swap) disponible, par exemple en utilisant top, htop ou ps -aux. Si l'utilisation de la mémoire d'échange dépasse régulièrement 50% de la mémoire d'échange disponible, vous devez ajouter plus de RAM physique à votre système. D'autres indications que de la RAM supplémentaire est nécessaire sont les messages «out of memory» dans les fichiers journaux, et, parfois, le serveur devient inactif pendant une période, souvent liée à l'analyse des spams et des virus et aux charges de courrier électronique élevées.
Cette article décrit la procédure de démarrage du serveur SME.
Installation
Lorsque vous démarrez à partir du CD d'installation, vous obtenez une invite de démarrage dans laquelle vous pouvez simplement appuyer sur Entrée pour démarrer la routine d'installation standard (ou de mise à niveau). Après avoir affiché l'invite de démarrage pendant un certain temps, SME lancera le processus d'installation automatiquement. Cela vous permettra ensuite de tester le support d'installation.
Ensuite, vous pouvez choisir la langue que vous souhaitez utiliser pour le processus d'installation qui suit.
Options de démarrage
Vous pouvez utiliser les clés de fonction F1 à F5 pour obtenir plus d'information sur les différentes options de démarrage.
Installation normale
sme
Configurer le type de RAID
sme raid=[none,0,1,5,6]
- Pour SME Server 8, «raid=none» et «raid=0» sont les configurations des RAID non logiciels, les autres arguments sont pour les types de RAID (par ex. Raid1, Raid5, Raid6).
- Pour SME Server 9, «raid=none» est la configuration du RIAD non logiciel, les autres arguments sont pour les types de RAID (par ex. Raid0, Raid1, Raid5, Raid6).
Définir le nombre de disques de rechange
Dans le cas où vous avez 3 disques durs ou plus sur votre serveur et que vous ne voulez pas avoir de disque de rechange :
sme spares=[0-(disks-2)]
Définir le type de lecteur à utiliser
Nommez les lecteurs que le programme d'installation utilisera pour installer le système d'exploitation ; un lecteur non nommé ne pourra être utilisé ; si cette option est laissée vide, cela inclura tous les lecteurs.
sme drives=[hda,sda,xvda,...]
Définir les lecteurs à exclure
Nommez les lecteurs sur lesquels l'installateur ne doit pas essayer d’installer le SE comme, par ex. une clé USB «bootable» contenant l'iso, ou d'autres lecteurs USB connectés de sauvegarde, voir la note ci-dessous :
sme exclude= sdc
Pour installer SME sans RAID logiciel
Par exemple, MB avec faux RAID ou avec le problème 'Config Disk' bugzilla:5850.
sme raid=0
Pour installer SME sans LVM
sme nolvm
Pour avoir /, /tmp, /var, /home/e-smith/files et swap sur des partitions séparées
sme multipart
Si vous avez un disque de pilotes
sme dd
L'installation se bloque
Le dernier écran affiché indique «Welcome to SME Server».
sme ide=nodma
dmraid (SME 8.1 désactivé par défaut)
Si nécessaire, peut être ajouté au démarrage :
sme dmraid
Erreur d'installation lorsque les disques utilisés l'ont été précédemment en «fake RAID»
sme ide=nodmraid
Erreur d'installation de pilote SATA
Par ex. les baies de l'«IntelliStation M Pro» d'IBM
sme acpi=off
Cartes-mère Intel DG965 (G33xx)
sme pci=nommconf acpi=off all-generic-ide
Pour activer le mode sauvetage, saisir
sme rescue
Pour utiliser un système de fichiers ext4 (pour SME 8 et antérieurs)
(sauf pour /boot) au lieu de l'ext3 par défaut :
sme ext4
Notes
Le programme d'installation, sans que rien ne soit effectué, doit se comporter de la même manière pour un nombre de disques inférieur à 10, sauf qu'il n'inclura aucun périphérique hébergé sur un lecteur nécessitant le module usb-storage ou spb2.
Si vous souhaitez inclure des lecteurs USB ou FireWire, vous devez utiliser l'option «drives=» et spécifier tous les lecteurs (pas seulement les lecteurs USB / Firewire) que vous souhaitez utiliser.
Si vous ne voulez pas utiliser raid, spécifiez «raid=0» ou «raid=none» (ces commandes sont identiques, «0» signifie «aucun»).
Si vous ne voulez pas de disque de rechange, vous devez utiliser l'option «spares=» et spécifier une valeur de 0. Par défaut, 1 disque de rechange sera prévu pour un nombre de disques supérieur à 3. Un autre disque de secours sera ajouté pour chaque groupe additionnel de 7 disques (10, 17, ...).
Si vous spécifiez un niveau de raid mais que vous ne disposez pas de suffisamment de disques, il reviendra au niveau de raid le plus élevé possible (par exemple, pour 5 disques avec 2 disques de rechange, RAID 6 échouera en RAID 5 car 5-2 = 3 lecteurs utilisables).
A partir des versions ISO des SME 7.5.1 et SME 8.0, le programme d'installation exclura automatiquement le lecteur contenant le support d'installation ou les fichiers ks. Voir http://forums.contribs.org/index.php/topic,46866.msg230681.html#msg230681.
Aide générale au démarrage
Certaines configurations matérielles peuvent avoir des problèmes avec la détection automatique du matériel effectuée pendant l'installation. Si vous rencontrez des problèmes lors de l'installation, redémarrez l'installation en ajoutant l'option noprobe. Avec l'installation normale, ce serait :
sme noprobe
ou par exemple si vous ne voulez pas de RAID logiciel :
sme noraid noprobe
et ainsi de suite.
Kernel Parameter Help
Some kernel parameters can be specified on the command line and will be passed to the kernel. This does not include options to modules such as ethernet cards or devices such as CD-ROM drives.
To pass an option to the kernel use the following format:
sme <options>
If a different installation mode is desired, enter it after the option(s).
For example, to install on a system with 128MB of RAM using noprobe mode, type the following:
sme mem=128M noprobe
To pass options to modules, you will need to use the noprobe mode to disable PCI autoprobing. When the installer asks for your device type that needs an option or parameter passed to it, there will be a place to type those in at that time.
Rescue Mode Help
The installer includes a rescue mode which can be used when a system does not boot properly. The rescue mode includes many useful utilities (editor, hard drive and RAID tools, etc.) which will allow one to restore a system to a working state.
To enter the rescue mode, boot your system from the installation CD-ROM and type:
sme rescue
To actually be able to edit files, remount the root partition by typing:
mount -n -o remount /
More
Some problems with booting that cannot or will not be fixed through development of SME8 and solutions on how to bypass them can be found here.
You can run Memtest86 to check your RAM by typing
memtest
at the boot prompt and pressing Enter afterwards.
There are many log files produced by SME Server. Some are standard, some are generated by contributions. This page aims to bring together enough knowledge to understand what generates each log file, what they are for, and how to interpret them.
Access
Access to log files is available with the server-manager, Chapter10#View_log_files and Chapter10#Mail_log_file_analysis
You can also use shell access, eg, to perform more complex searches or manipulations.
Logfile Names
E-mail logfiles
qmail - details mail distribution (to mailboxes and to other hosts via SMTP). Traces connections, message numbers, bytes, concurrency, and UID. imap - connections to the server IMAP folders (IMAP). Shows connections from local device unless IMAP enabled for internet access. Use in conjunction with other logs to trace email. imaps - secure connections to the server IMAP folders (IMAPS). Shows connections from local devices unless IMAPS enabled for internet access. Use in conjunction with other logs to trace email. pop3 - Details connections via pop3 to the server. pop3s - Details connections via pop3s to the server. smtp-auth-proxy maillog - nothing. Empty. qpsmtpd - incoming SMTP connections. sqpsmtpd - incoming Secure SMTP connections. Authenticated SMTP Via SSL port 465. clamav - antivirus clamd freshclam spamd - spam
In SME9 IMAP connections are logged in /var/log/dovecot/current
HTTP logfiles
httpd httpd-admin squid squid.run qpdmtpd
System logfiles
messages dnscache iptables iptraf mysqld nmbd ntpd oidentd ppp yum tinydns wan vbox cron sshd flexbackup dhcpd dhcpcd dmesg pppoe pptpd spooler radius radiusd proftpd raidmonitor rpmpkgs sa samba secure rkhunter.log boot.log audit anaconda.log anaconda.syslog lastlog
Error Messages
- Log message regarding permissions on /var/spool/qpsmtpd/
You may see messages similar to this in your log file:
@400000004326e9472eccc42c 3243 trying to get config for spool_dir @400000004326e9472ed518fc 3243 Permissions on spool_dir /var/spool/qpsmtpd/ are not 0700
They can be safely ignored. Clamav runs under a different user and needs read access to the spool area to avoid copying the file. [[10]]
- I get messages that look like: (pam_unix)[31705]: session opened for user root by (uid=0)
Most likely these messages coming from a package called SYSSTAT. The package was included in the previous versions of SMESERVER but were removed from the final version of V7. If you see the messages, most likely you had a previous version and upgraded. SYSSTAT isn't needed unless you have a contrib package called SME7ADMIN.
You can safely remove the package by:
yum remove sysstat
Please note that these messages may be caused by other cron jobs (tasks that run automatically) or packages authenticating as root.
- I get a message saying that: the RSA server certificate CommonName (CN)`servername.domainname.tld' does NOT match server name!
If you change the servername, you will be prompted to reboot. When you do, the SMESERVER will generate a certificate for the new servername-domainname combination and httpd.conf will now reference that new name. References to other virtual domains and hosts will generate warnings in the log.
- I get: server squid[3145]: WARNING: Disk space over limit: 148412 KB > 102400 KB.
This message is just log noise. The message is informational and squid takes care of the issue itself.
- I get in the radius log: Info: Using deprecated naslist file. Support for this will go away soon.
This is just the radius daemon (a computer program that runs in the background, rather than under the direct control of a user) complaining about a file that exists in the directory. We don't use it.
- I get in the clamd log: Error: cli_untar: only standard TAR files are currently supported
Clam (the antivirus portion of SMESERVER) has found a file type which it can't deal with, and so is telling you that it can't scan that file.
Nothing to be concerned about. The fix, if any arrives, will come from the Clam team if they Determine this file format is worthy of their attention.
- I get in the smeserver-clamscan.log: LibClamAV Warning: Multipart/alternative MIME message contains no boundary header.
This is just log noise. Clamav is scanning badly formatted MIME mail.
- In the /var/log/messages, I get: 10fix_privilege_tables: ERROR
You can safely ignore these errors. The errors just mean that your tables are already up to date.
- In the /var/log/messages, I get: rec_read bad magic....
You may also see it with
cat /var/log/samba/* |grep printing |grep 'rec_read bad magic'
You can delete /var/cache/samba/printing/<printer>.tdb files & restart samba.
rm /var/cache/samba/printing/<printer>.tdb /etc/init.d/smbd restart
- cannot remove /var/run/dovecot/login: is a directory
You may see this on system startup. It is just noise and doesn't affect anything.
- I get:
rules: score undef for rule 'MISSING_SUBJECT' in 'MISSING_SUBJECT' at /usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line 2140.
Ignore the message. The warnings are just log noise. After a SPAMASSASSIN update, the rules have been added but don't have a score associated with them. So they will be treated as non-existent and result in an error message.
- I get:
2008-02-21 23:42:51.106904500 ClamAV update process started at Thu Feb 21 23:42:51 2008 2008-02-21 23:42:51.108696500 WARNING: Your ClamAV installation is OUTDATED! 2008-02-21 23:42:51.108700500 WARNING: Local version: 0.92 Recommended version: 0.92.1 2008-02-21 23:42:51.108704500 DON'T PANIC! Read http://www.clamav.net/support/faq 2008-02-21 23:42:51.108708500 main.inc is up to date (version: 45, sigs: 169676, f-level: 21, builder: sven) 2008-02-21 23:42:51.523757500 ERROR: cdiff_apply: lseek(desc, -350, SEEK_END) failed 2008-02-21 23:42:51.523760500 ERROR: getpatch: Can't apply patch 2008-02-21 23:42:51.523764500 WARNING: Incremental update failed, trying to download daily.cvd 2008-02-21 23:42:52.322303500 WARNING: Mirror 193.1.193.64 is not synchronized.
or:
2008-02-22 00:44:14.874648500 Ignoring mirror 193.1.193.64 (due to previous errors) 2008-02-22 00:44:14.878360500 ERROR: Can't download daily.cvd from database.clamav.net 2008-02-22 00:44:14.879769500 Giving up on database.clamav.net...
Ignore the message. CLAMAV will fix itself on its own. The message is from CLAMAV saying it can't reach the updates. The messages will go away once they can be reached. Check Bugzilla:4002 and Bugzilla:3962
If you lose patience waiting for the messages to go away, you can execute the following commands:
cd /var/clamav/ mv mirrors.dat mirrors.dat.old sv t /service/freshclam
- After a ClamAV update or when freshclam is run, the following may appear in the log file
LibClamAV Warning: Detected duplicate databases /var/clamav/main.cvd and /var/clamav/main.cld, please manually remove one of them
If you just leave it, freshclam should take of this as it is just log noise. See Bugzilla 7164
RK Hunter Messages
Root Kit Hunter performs a daily check of your system, these are common warnings.
/etc/cron.daily/01-rkhunter
- The following processes are using deleted files
xyz
- Process '/sbin/XXX' (PID 3869) is listening on the network.
xyz
- The SSH and rkhunter configuration options should be the same:
xyz
- Warning: SSH protocol v1 has been enabled
Servers that have been upgraded to 7.3 from 5.5 give warnings that SSL protocol V1 is enabled.
If you know that you do not use SSH protocol V1 (not SSL!), then you can remove protocol 1 by doing:
config setprop sshd Protocol 2 signal-event remoteaccess-update
Is this article helpful to you?
Please consider donating or volunteering
Thank you!
Information on the email subsystem used in SME Server covering sending/recieving, spam filtering, virus checking, webmail, domains and users.
Troubleshooting
I am having trouble getting sme to send and receive email.
Sending and receiving email are separate functions. You need to investigate each individually.
Sending
If SME server does not send mail, you need to examine the /var/log/qmail/current logs to see what happens when it tries. Most commonly problems can be solved by sending via your ISP's mail server, possibly using encryption and/or authentication. Read the manual.
Receiving
If SME server does not receive mail, then you need to ensure that SMTP connections reach your SME server (DNS settings, router configuration, ISP port blocks) and then you need to examine /var/log/qpsmtpd/current logs to determine what SME server does with the incoming connections. Most problems are DNS, router or ISP issues, and have nothing to do with SME server operation or configuration.
qpsmtpd "Connection Timed Out" errors
See Bugzilla:6888 and Bugzilla:2360
A qpsmtpd timeout error may arise, this is not an issue that is caused by SME server directly, however it can become an issue depending on hardware and configuration settings that are contained in and around other enviroments.
It is discussed under various names
- Path MTU Discovery Blackhole http://www.phildev.net/mss/mss-talk.pdf
- Path MTU Discovery Failures http://www.wand.net.nz/~mluckie/pubs/debugging-pmtud.imc2005.pdf
- TCP Problems with Path MTU Discovery http://www.ietf.org/rfc/rfc2923.txt
As discussed in Bugzilla:6888 a workaround was found that may help in mitigating the issue.
The tracepath utility (included with SME 8.0 and SME 7.6) can be used to locate non-standard MTU values between your SME server and any remote host.
You can discover the smallest MTU between you and google.com (for example) by running this command, then locating the smallest value of "pmtu" in the results:
tracepath google.com
If tracepath returns any value below 1500 between your SME server and a mail server that you need to receive email from, you may need to reset the MTU on the SME server to match the smallest value returned.
For example, if tracepath returns 1492 (typical for internet connections using PPPoE), you would need to set the MTU on your SME server to the same value (1492) using the following:
config setprop InternalInterface MTU 1492 signal-event post-upgrade; signal-event reboot
Webmail broken after upgrade
After the usual post-upgrade and reboot, webmail is broken with messages like the following in the messages log:
Apr 20 17:29:53 mail [4614]: PHP Fatal error: Call to a member function on a non-object in /home/httpd/html/horde/imp/lib/Block/tree_folders.php on line 65 Apr 20 17:29:53 mail [4614]: PHP Warning: Unknown(): Unable to call () - function does not exist in Unknown on line 0
As workaround, logout of Horde, close the browser, reopen, log in to Horde, Webmail should now be fully functional. (Based on suggested fix in Bugzilla:5177)
Spam
Spamassassin
Spam filter with Server-Manager
Using the Server-Manager Configuration/E-Mail panel, adjust the settings to these reasonable defaults.
- Virus scanning Enabled
- Spam filtering Enabled
- Spam sensitivity Custom
- Custom spam tagging level 4
- Custom spam rejection level 12
- Sort spam into junkmail folder Enabled
- Modify subject of spam messages Enabled
I would also recommend blocking all executable content. To do so, select (highlight) all of the attachment types other than zip files (the last two).
Click Save.
How It Works
When receiving an incoming message, the server first tests for RBL and DNSBL listings, if enabled. If the sender is blacklisted, the messages are blocked outright and Spamassassin never sees it.
With this configuration, the spammiest messages, those marked as 12 or above, will be rejected at the SMTP level. Those spam messages marked between 4 and 12, will be routed to the users' (IMAP) junkmail folder. This is done so the users can check for false-positives...valid messages that were classified as spam by SpamAssassin.
Users may check their junkmail folders for false-positives via webmail, or, if they are using an IMAP mail client, by simply checking the junkmail folder exposed by their mail client.
https://servername/webmail
Enable/Disable Filtering Per-User
This procedure doesn't really disable the spam filtering, it just stopps the spam from being routed to the 'junkmail' folder.
Per-user filtering is enabled by default. Disable filtering with the following command, as root:
db accounts setprop USERNAME SortSpam disabled db accounts show USERNAME # only displays settings signal-event user-modify USERNAME
Use the Junkmail folder
The Default spamassassin behaviour put spams in the inbox which is very convenient for users in case of false positive, but it is not practical for learning, and especially it does not facilitate the life of the user (setting is available via the manager). If you want to put directly spams in the junkmail folder issue the command above.
config setprop spamassassin SortSpam enabled signal-event email-update
Message Retention Time
Set spamassassin for automatically delete junkmail. You can change the "days" that spamassassin sets to automatically delete junkmail, to delete after two months
db configuration setprop spamassassin MessageRetentionTime 60 signal-event email-update
Spam score Level and Spam score rejection
The "Custom spam rejection level" will only work when "Spam sensitivity" is set to custom.
- Open server-manager.
- Click e-mail in the navigation pane (left-hand side).
- Click Change e-mail filtering settings.
- Change "Spam sensitivity" to custom and adjust the settings to your liking.
This happens because by default, no mail (except for viruses) gets rejected without the admin doing something first.
As a reference, the following setting will have the following behaviours :
| Sensitivity | Spam tagging level | Spam rejection level |
|---|---|---|
| Custom | TagLevel value (Custom spam tagging level) |
RejectLevel value (Custom spam rejection level) |
| veryhigh | 2 | No rejection |
| high | 3 | No rejection |
| medium | 5 | No rejection |
| low | 7 | No rejection |
| verylow | 9 | No rejection |
X-Spam-Level Header in Email Messages
SME does not create an X-Spam-Level header in processed email messages by default.
To enable this capability:
/usr/bin/yum install --enablerepo=smecontribs smeserver-qpsmtpd-spamassassinlevelstars signal-event email-update
(Based on Bugzilla:3505)
spamassassin qpsmtpd's plugins email size limit
This db configuration setting sets the maximum email size above which spamassassin will not apply the spam filtering rules as have been set.
The default setting is 500kb, to increase the maximum size, apply the following commands from a root terminal
db configuration setprop spamassassin MaxMessageSize 2000000
increases message size to 2mb, apply the change with
signal-event email-update
(Based on Bugzilla:7606)
Custom Rule Scores
You can customize the score assigned by a specific Spamassassin rule (SARE_ADULT2 in this case) as follows:
mkdir -p /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf cd /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf echo "score SARE_ADULT2 20.000" >> 20localscores signal-event email-update
You can now add additional tests and custom scores by editing the newly-created template fragment 20localscores and adding new custom scores using:
nano -w /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores signal-event email-update
Each custom score goes on its own line. If you enter a score surrounded by parentheses, the "custom" score will be added to the default score for the specified test (use score TEST_NAME (-1) to reduce the score for 'TEST_NAME' by 1)
You can remove these customizations using:
rm -f /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores signal-event email-update
References:
- http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Conf.html#scoring_options
- http://spamassassin.apache.org/tests_3_2_x.html
- http://www.rulesemporium.com/
SPF mail rejection/flagging policy
SME server can protect based of SPF records using spamassassin and the 'sender_permitted_from' plugin. The following lines will enable the plugin.
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/ cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/ echo sender_permitted_from spf_deny 1 > 30spf /sbin/e-smith/expand-template /var/service/qpsmtpd/config/peers/0
Then set your custom rule scores using the Custom Rule Scores section of this page. You should base these scores on your settings in server-manager > Configuration > Email > Change e-mail filtering settings or via db config commands for those with that skillset
echo "score SPF_SOFTFAIL 6.000" >> 20localscores echo "score SPF_FAIL 14.000" >> 20localscores signal-event email-update
In our testing an email that doesn't match SPF records and the sender domain owner has defined a soft fail, if is attributed 6 points and sorted to junkmail folder. If the sender domain owner has defined a hard fail the email attibuted 14 points and is subsequently rejected.
References (but instructions changed to meet new qmail structure):
Pyzor Timeout
See Bugzilla: 5973
This can be mitigated by the adding of a template fragment.
Template fragment to set a pyzor_timeout based on a value in the config db. If no value is set, there is no output (so pyzor uses it's internal default).
mkdir -p /etc/e-smith/templates/etc/mail/spamassassin/local.cf/50pyzor_timeout cd /etc/e-smith/templates/etc/mail/spamassassin/local.cf/50pyzor_timeout nano 50pyzor_timeout
Contents of 50pyzor_timeout
{
my $pyzor_timeout = ($spamassassin{PyzorTimeout} || 0);
if ($pyzor_timeout ne '0')
{
return "pyzor_timeout " . ($pyzor_timeout);
}
}
Then a value can be set using:
config setprop spamassassin PyzorTimeout 15 signal-event email-update
Whitelist and Blacklist
If mail comes in and it is misclassified as spam by Spamasassin, you can add the sender to the Spamassassin whitelist so that future messages coming in from that sender are not filtered. Conversely, you can add a spammer to the Spamassassin blacklist so you never see their spam again. Add senders (or their entire domains) to the global whitelist (or blacklist) with commands similar to these (as root):
db spamassassin setprop wbl.global *@vonage.com White db spamassassin setprop wbl.global *domain2.com White db spamassassin setprop wbl.global user@domain3.com White db spamassassin setprop wbl.global spammer@spamdomain.com Black
you can block an entire TLD but please be aware that you might be denying a legitimate email in the future.
db spamassassin setprop wbl.global *@*.xyz Black db spamassassin setprop wbl.global *@*.link Black
expland template and save the configuration to the database
signal-event email-update
You can view the lists with this command:
db spamassassin show
These lists can be also controlled by the server-manager with the wbl contrib http://wiki.contribs.org/Email_Whitelist-Blacklist_Control
Testing
You can check the auto-learning statistics with this command. You will be able to note the accumulation of the spam tokens (or not). Note that the Bayesian filtering must receive 200 spam messages before it starts to function, so don't expect instantaneous results.
sa-learn --dump magic
You can check the spam filter log with this command:
tail -50 /var/log/spamd/current | tai64nlocal
Check spamassassin configuration like this:
spamassassin -D --lint
If you ever see an error such as:
warn: bayes: cannot open bayes databases /etc/mail/spamassassin/bayes_* R/W: tie failed: Permission denied
Try adjusting some permissions with these commands:
chown :spamd /var/spool/spamd/.spamassassin/* chmod g+rw /var/spool/spamd/.spamassassin/*
Real-time Blackhole List (RBL)
Enabling RBL's
RBL's are disabled by default to allow maximum accommodation (your ISP may be on a RBL & you may not know it). You can enable RBL's by:
config setprop qpsmtpd DNSBL enabled RHSBL enabled signal-event email-update
You can see your RBL's by:
config show qpsmtpd
You can add to your RBL's by:
config setprop qpsmtpd RBLList <rbl-list-name> signal-event email-update
Many will argue what's best, some say the SME defaults are too aggressive and affect some popular free webmail accounts, but most would agree that you can set stable, conservative and non aggressive settings by:
config setprop qpsmtpd RBLList zen.spamhaus.org signal-event email-update
A conservative setting for the associated DNSBL SBLList is:
config setprop qpsmtpd SBLList dbl.spamhaus.org signal-event email-update
Note: More information on this topic can be found here:
[11]
[12]
Possible issues with RBL
When an external dns provider is set in the console menu, it may interfere with some blacklists activated here (RHSBL and DNSBL). The black.uribl.com is know to bounce all emails in this case with a rejection message delivered to the sender. You can in this case
- Remove the black.uribl.com of your SBLList
config setprop qpsmtpd SBLList multi.surbl.org:rhsbl.sorbs.net:dbl.spamhaus.org signal-event email-update
- Let the SME Server being the only dns resolver by removing the dns provider/forwarder in the console menu.
See http://uribl.com/about.shtml#abuse for more information about this issue with black.uribl.com
Obsolete lists
These lists can not be used with smeserver. A migrate fragment will remove them from your settings each time you reconfigure your server.
- RBLList
combined.njabl.org
list.dsbl.org
multihop.dsbl.org
dnsbl.ahbl.org
- SBLLIST
blackhole.securitysage.com
bulk.rhs.mailpolice.com
fraud.rhs.mailpolice.com
porn.rhs.mailpolice.com
adult.rhs.mailpolice.com
bogusmx.rfc-ignorant.org
ex.dnsbl.org
Server Only
Some of the spam filter rules cannot work unless the SMESERVER knows the external IP of the box. If you put a SMESERVER in server-only mode behind other firewalls, it will lose some of the anti-spam rules. For example, the rule that blocks attempts where spammers try "HELO a.b.c.d" where a.b.c.d is your external IP address.
Unfortunately, many admins believe that port-forwarding SMTP provides additional security. It doesn't, it limits the SMESERVER's ability to apply some rules.
I want to enable GreyListing
GreyListing support is under the covers and can easily be enabled for those who know what they are doing. However, many experienced users found that they spent more time looking after the greylisting configuration than they received in benefit. see Greylisting
Bayesian Filtering
From Wikipedia:
Naive Bayes classifiers work by correlating the use of tokens (typically words, or sometimes other things), with spam and non-spam e-mails and then using Bayes' theorem to calculate a probability that an email is or is not spam.
SME server supports bayesian filtering, but does not have it enabled by default.
Enabling bayesian filtering, autolearning, and spam/ham training allows spamassassin to learn from received email and improve spam filter performance. Bugzilla: 6822
Bayesian Autolearning
The following command will enable the bayesian learning filter and set thresholds for the bayesian filter.
config setprop spamassassin UseBayes 1 config setprop spamassassin BayesAutoLearnThresholdSpam 6.00 config setprop spamassassin BayesAutoLearnThresholdNonspam 0.10 config setprop spamassassin UseBayesAutoLearn 1 expand-template /etc/mail/spamassassin/local.cf sa-learn --sync --dbpath /var/spool/spamd/.spamassassin -u spamd chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_* chown spamd.spamd /var/spool/spamd/.spamassassin/bayes.mutex chmod 640 /var/spool/spamd/.spamassassin/bayes_* config setprop spamassassin status enabled config setprop spamassassin RejectLevel 12 config setprop spamassassin TagLevel 4 config setprop spamassassin Sensitivity custom config setprop spamd SpamLearning enabled signal-event email-update
These commands will:
- enable spamassassin
- configure spamassassin to reject any email with a score above 12
- tag spam scored between 4 and 12 in the email header
- enable bayesian filter
- 'autolearn' as SPAM any email with a score above 6.00
Note: SpamAssassin requires at least 3 points from the header, and 3 points from the body to auto-learn as spam. Therefore, the minimum working value for this option is 6, to be changed in increments of 3, 12 considered to be a good working value..
- 'autolearn' as HAM any email with a score below 0.10
Check the bayes stats with the command:
sa-learn --dump magic
The database is located in /var/spool/spamd/.spamassassin/bayes
LearnAsSpam / LearnAsHam (spam/ham training)
LearnAsSpam & LearnAsHam are scripts that can be installed on your server to allow users to manually "train" the bayes database. Training is done by users moving Spam from their Inbox to the "LearnAsSpam" folder, and by COPYING real email that was delivered to junkmail into the "LearnAsHam" folder. All messages in both LearnAsSpam and LearnAsHam are deleted once they have been processed and their tokens have been added to the bayes database.
To install:
- Enable bayes database as described in Bayesian Autolearning (not the best approach, prefer manual learn by user), or
- Install smeserver-learn as per wiki page Learn(and keep auto-learning off), then
- Instruct your users to move any SPAM they find from their Inbox to their LearnAsSpam folder, and to COPY any non-spam (ham) they find in their junkmail folder into their LearnAsHam folder.
This is a really efficient way to reduce impact of SPAM to your particular installation. Do not fear to run again files that are tagged as SPAM, as they will either get ignored if all their patterns are known, or the Bayes might catch one more pattern that could help you to get ride of the next incoming SPAM to even get accepted.
If you want, the code below counts how many e-mail are in LearnAsSpam and LearnAsHam directories (of all users). It's useful to know if your users are using those folders. However Learn will send you a report after each pass. If you are interested on the number of emails lefts in the junkmail directory without any attention, you could install smeserver-mailstats and activate the option to account for them
#!/bin/bash
# ContaLearn.sh
#for compatibility with older versions without rpm, testing
[ `/sbin/e-smith/db configuration getprop LearnAsSpam dir` ] &&
LearnAsSpam=`/sbin/e-smith/db configuration getprop LearnAsSpam dir` || LearnAsSpam='LearnAsSpam';
[ `/sbin/e-smith/db configuration getprop LearnAsHam dir` ] &&
LearnAsHam=`/sbin/e-smith/db configuration getprop LearnAsHam dir` || LearnAsHam='LearnAsSpam';
JunkMail='junkmail';
echo
date
declare -i tspam
declare -i tham
declare -i tleft
declare -i tnseen
printf "%-25s %-11s %-11s %-11s %-11s \n" "User" "LearnAsSpam" "LearnAsHam" "JunkMail" "NotSeen"
pushd /home/e-smith/files/users/ >>/dev/nul
for u in `ls ` #| grep -v admin`
do
[ "$u" = "admin" ] && mailpath="/home/e-smith/" || mailpath="/home/e-smith/files/users/$u" ;
spam=`ls -1 $mailpath/Maildir/.$LearnAsSpam/cur |wc -l`
ham=`ls -1 $mailpath/Maildir/.$LearnAsHam/cur |wc -l`
left=`ls -1 $mailpath/Maildir/.$JunkMail/cur |wc -l`
nseen=`ls -1 $mailpath/Maildir/.$JunkMail/new |wc -l`
if [[ $spam > 0 ]] || [[ $ham > 0 ]] || [[ $left > 0 ]] || [[ $nseen > 0 ]]; then
printf "%-25s %-11d %-11d %-11d %-11d \n" $u $spam $ham $left $nseen
fi
tspam=$tspam+$spam
tham=$tham+$ham
tleft=$tleft+$left
tnseen=$tnseen+$nseen
done
echo "----------------------------------------------------------------------"
printf "%-25s %-11d %-11d %-11d %-11d \n" "Total:" $tspam $tham $tleft $tnseen
echo
popd >>/dev/nul
Learn Contrib
The Learn contrib is intended to install and configure the bayes training tools LearnAsSpam & LearnAsHam.
Reset the Bayes Database
Based on this forum post http://forums.contribs.org/index.php/topic,50712.msg258844.html#msg258844 it may be advantageous to remove the bayes database every few years & recreate it, in order to improve spam filtering performance.
Follow these instructions to turn bayes OFF, delete the database, create an empty database, and turn bayes back on:
config setprop spamassassin UseBayes 0 signal-event email-update 'rm' /var/spool/spamd/.spamassassin/bayes*
config setprop spamassassin UseBayes 1 expand-template /etc/mail/spamassassin/local.cf sa-learn --sync --dbpath /var/spool/spamd/.spamassassin -u spamd chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_* chown spamd.spamd /var/spool/spamd/.spamassassin/bayes.mutex chmod 640 /var/spool/spamd/.spamassassin/bayes_* signal-event email-update
Updates to smeserver-spamassasin now require two new config db settings to have bayesian autolearning enabled. See forum post https://forums.contribs.org/index.php/topic,54320.msg284208.html#msg284208
The Sonora Communications "Spam Filter Configuration for SME 7" howto
http://www.sonoracomm.com/support/19-inet-support/49-spam-filter-configuration-for-sme-7
GeoIP: spam blocking based on geographical information
The GeoIP plugin for Spamassasin lets us know where our mail server is receiving mail from. If we're receiving too much spam from a particular location, this will help track it down. We can then use that info to reject connections from that place taking the load off our server.
You can find information how to install and use it on the GeoIP page.
Anti Virus
SME Server uses Clam AntiVirus (http://www.clamav.net) as the default and built-in anti virus engine.
Signatures
By default SME Server will automatically get virus signature database updates from ClamAV.
Other people and organizations have developed additional signatures which can also be used with ClamAV to provide extra protection. Databases of these signatures can be downloaded and installed on SME Server, and used by ClamAV
In order to automate the download and installation of the additional databases, as well as control which databases you use, follow the instruction in the Virus:Additional Signatures Howto
Heuristic Scan
HeuristicScanPrecedence is a new option in clamav 0.94.
When enabled, if a heuristic scan (such as phishingScam) detects a possible virus/phish it will stop scan immediately. Recommended, saves CPU scan-time.
To enable this feature:
config setprop clamav HeuristicScanPrecedence yes expand-template /etc/clamd.conf sv t clamd
Default is disabled.
Attachment Filtering
The functionality to block possible executable and virus files attached to emails has been incorporated into SME Server v7.x. See the Email panel in server manager.
Additional file signature patterns can be added to the SME defaults. See the Virus:Email Attachment Blocking Howto for further information
Email Clients
"concurrency limit reached" when using IMAP
Sometime shows as Thunderbird giving this error message, This Mail-server is not a imap4 mail-server
To workaround thunderbirds limitations change, this thunderbird setting to false
- Preferences, Advanced, Config editor (aka about:config): filter on tls.
- set security.enable_tls to false
If the total concurrency limit is reached, it'll look like this in /var/log/dovecot/current:
@400000005a1c2c1f19c9381c master: Warning: service(imap): process_limit (2) reached, client connections are being dropped
@400000005a1c2c291a4712dc imap-login: Error: read(imap) failed: Remote closed connection (destination service { process_limit } reached?)
@400000005a1c2c291a471aac imap-login: Error: read(imap) failed: Remote closed connection (destination service { process_limit } reached?)
For the per IP concurrency limit, it'll be like this:
@400000005a1c2c6214542b94 imap-login: Info: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=2): user=<someone>, method=PLAIN, rip=192.168.x.y, lip=192.168.z.t, TLS, session=<abcdefgh>
@400000005a1c2c6233f1bcb4 imap-login: Info: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=2): user=<someone>, method=PLAIN, rip=192.168.x.y, lip=192.168.z.t, TLS, session=<ijklmnop>
The following commands will give your the current value:
db configuration getprop imap ConcurrencyLimit || echo 400 db configuration getprop imap ConcurrencyLimitPerIP || echo 12
You can also increase the ConcurrencyLimitPerIP and/or ConcurrencyLimit value for imap and/or imaps (secure)
config setprop imap ConcurrencyLimitPerIP 20 config setprop imaps ConcurrencyLimitPerIP 20 signal-event post-upgrade; signal-event reboot
To see configuration:
config show imap
tail -f /var/log/dovecot/current | tai64nlocal #out of date
More detail can be found here or here.
Mail server is not an IMAP4 mail server
This is a bug in Thunderbird, the previous tips may help.
The Bat
The gives this error message, but they are wrong.
"This server uses TLS v3.0 which is considered to be obsolete and insecure.
The server must use TLS v3.1 or above."
Outlook/Outlook Express give error 10060/0x800CCC90
Most likely OUTLOOK (EXPRESS) isn't configured correctly.
-open OUTLOOK -click TOOLS > ACCOUNTS -click CHANGE (on the right-hand side) -find INCOMING MAIL SERVER & OUTGOING MAIL SERVER (on right-hand side) -type: mail.yourdomain.tld (in both places) -click MORE SETTINGS (on bottom-right) -click OUTGOING SERVER tab (at the top) -checkmark "MY OUTGOING SERVER REQUIRES AUTHENTICATION" -bullet "USE SAME SETTINGS AS INCOMING MAIL SERVER" -click ADVANCED tab (at the top) -find OUTGOING SERVER -checkmark "THIS SERVER REQUIRES A SECURE CONNECTION" (under outgoing server) -change 25 to 465 -[possibly required, secure IMAP is 993] -click OK > NEXT > FINISHED -you're finished, your email should work now
Outlook 2013 on Windows 10 gives "An unknown error occurred, error code 0x8004011c" when attempting an IMAP connection for a DOMAIN user
This is a known issue with the above combination of Windows and Outlook version as of 2015-02-18 (see: Bug 9618).
The following registry key resolves the issue: To work around this problem, set the value of the ProtectionPolicy registry entry to 1 to enable local backup of the MasterKey instead of requiring a RWDC in the following registry subkey:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb] "ProtectionPolicy"=dword:00000001
The PortectionPolicy entry may need to be created
Outlook 2013 on Windows 8.1 gives error 0x800CCC1A when sending over SMTP port 465
This is a known issue with the above combination of Windows and Outlook version as of 2015-02-18 (see: Bug 8854).
The following client-side workaround has been suggested on the dovecot mailinglist:
Disable TLS1.2 on the Windows 8.1 client, using a registry entry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.2\Client] "DisabledByDefault"=dword:00000001 "Enabled"=dword:00000000
If the registry entry above does not exist on your system, you will have to create it manually.
Whether this is OpenSSL or Microsoft's "fault" is currently not answered.
Outlook test message doesn't come through
You clicked the TEST ACCOUNT SETTINGS in OUTLOOK didn't you? This is a bug in OUTLOOK. The test message sends a test email with 'no Date header'. As the name suggests, this means a message without any date. Since the server doesn't accept mail with 'no Date header' (because it's required) the message is rejected. To test, send an actual message from OUTLOOK.
If you want, you can try THUNDERBIRD. It's like OUTLOOK but made by a different company. It's completely free and works very well at home and at the office.
I can't receive/send email from my application (ACT!, vTiger, MS Outlook, etc)
Most likely, this is a bug the application you're using and not a problem with the SMESERVER. The application sends an email with 'no Date header'. As the name suggests, this means a message without any date. Since the server doesn't accept mail with 'no Date header' (because it's required) the message is rejected.
As a workaround you can disable the check for the 'Date header'. To disable this check on the internal interface:
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local echo "# 17check_basicheaders disabled by custom template" > \ 17check_basicheaders signal-event email-update
To disable this check for the external interface:
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0 cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0 echo "# 17check_basicheaders disabled by custom template" > \ 17check_basicheaders signal-event email-update
After I upgrade my SME Server, my email folders have disappeared when using IMAP
After upgrade, if there are missing IMAP folders, the client may need to re-subscribe to folders. This may affect either webmail users or users who use an IMAP email client.
Entourage: Using SME's Self-Signed Certificate for SSL Connections from Entourage on OS X 10.4
The main problem here is that Entourage will only support trusted, PEM Base-64 Encoded certificates. To use IMAPS or SMTPS from Entourage with your SME server, you will need to:
1. Login to your Mac as a user with administrative privileges 2. Open Safari and browse to https://smeserver/server-manager. When you receive the warning about your certificate: - click on "Show Certificate" - click and drag the gold-rimmed image of a certificate to your desktop. You will now have myserver.mydomain.tld.cer on your desktop. 3. Locate and open the Microsoft Cert Manager - "Import" the certificate you downloaded in step 2. 4. Highlight the imported certificate and "Export" it. - Select the "PEM..." format - add "pem." to the beginning of the filename - export it to your Desktop 5. Double-click on the new pem.myserver.mydomain.tld.cer - Apple's Keychain Access application will open. - Select the X509Anchors Keychain and click "OK" 6. While still in Apple's Keychain Access, select the "Certificates" category - Drag pem.myserver.mydomain.tld.cer into the certificates window.
You should now be able to connect to your SME from your Entourage using IMAPS.
If you are accessing your SME server using a different name than the one encoded in the certificate you will still receive a security warning from Entourage, but "OK" will now grant access to your folders.
Notes:
- Procedure mostly taken from http://www.kerio.com/manual/kmsug/en/ch09s06.html
- I still get various other IMAP errors due, I suspect, to the "concurrency limit reached" issue.
- Click on "Show Keychains" in Apple's "Keychain Access" if you need to delete a certificate and try again.
How do I get my e-mail to show the correct From Address
The From address on an e-mail is not supplied by the server. It is supplied by the e-mail client.
- Configure your Account in your e-mail client with the correct FROM address.
- You can change the FROM address in webmail with the following:
- Login to webmail as the user, go to options-personal information and change the identity to have the correct FROM address. You can have multiple identities with a single user.
Some system generated email is created by the server, some contribs may send mail externally, in these cases you need a valid domain name for the server, buy one or use a free provider like dyndns.org
Outlook 365 / Outlook 2019 IMAP Configuration
Microsoft has disabled the ability to enter the IMAP/SMTP username in the account setup wizard in Outlook 365 / 2019 for Windows. The wizard used within Outlook requires that the IMAP/SMTP username be the full email address.
To work around this issue, setup the account using "Mail (Microsoft Outlook 2016)" in the Windows control panel:
Server Settings
qmail ConcurrencyLocal
The default value for /var/qmail/control/concurrencylocal is 20. This setting controls the maximum amount of simultaneous local deliveries.
There is a optional database property (does not show unless changed from the default setting) called ConcurrencyLocal for qmail in the config database. The ConcurrencyLocal property changes the value stored in /var/qmail/control/concurrencylocal.
It can be set, for example to decrease the local concurrency limit
config setprop qmail ConcurrencyLocal 6 signal-event email-update
qmail ConcurrencyRemote
The default value for /var/qmail/control/concurrencyremote is 20. This setting controls the maximum amount of simultaneous remote deliveries.
There is a optional database property (does not show unless changed from the default setting) called ConcurrencyRemote for qmail in the config database. The ConcurrencyRemote property changes the value stored in /var/qmail/control/concurrencyremote.
It can be set, for example to decrease the remote concurrency limit
config setprop qmail ConcurrencyRemote 10 signal-event email-update
Refer also this comment by CB
http://forums.contribs.org/index.php/topic,50091.msg251320.html#msg251320
How long retry before return e-mail as undeliverable
To configure how long SME server will try to delivery a message before return a permanent error
mkdir -p /etc/e-smith/templates-custom/var/qmail/control echo 172800 > /etc/e-smith/templates-custom/var/qmail/control/queuelifetime expand-template /var/qmail/control/queuelifetime sv t qmail
The default value is 604800 seconds, or one week.
The example above shows 172800 seconds, or two days (a weekend for infra upgrade!)
source: http://forums.contribs.org/index.php/topic,47471.0.html
Double bounce messages
To stop admin receiving double bounce messages
config setprop qmail DoubleBounceTo someoneuser signal-event email-update
Or just delete them. You risk losing legitimate double bounces (which are rare, but you want to look at them when they do occur)
config setprop qmail DoubleBounceTo devnull signal-event email-update
see a longer explaination here
Keep a copy of all emails
You may need to keep a copy of all emails sent to or from your email server. This may be for legal, or other reasons.
The following instructions will create a new user account (default is maillog) and forward every email that goes through your SME server to it.
First, log onto the server-manager and create the user maillog
Go to the SME Command Line (logon as root) and issue the following commands:
config setprop qpsmtpd Bcc enabled signal-event email-update
Optionally make the forwarding of the emails invisible to the end user. Without it, there will be an X-Copied-To: header in each email. Run this command before the signal-event
config setprop qpsmtpd BccMode bcc
If you want to view the emails, point your email client at the SME and log on as maillog.
You can modify the default user:
config setprop qpsmtpd BccUser someuser
Keep a copy of outgoing emails only
In addition to the commands in the previous section we will also have to create a custom template as follows:
Log in as root or a user with root privileges
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/ cp /etc/e-smith/templates/var/service/qpsmtpd/config/peers/0/13bcc /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/ cd /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/ nano -w 13bcc
change the code to:
{
return "# bcc disabled" unless ($qpsmtpd{Bcc} eq "enabled");
return "bcc mode " . $qpsmtpd{BccMode} . " outgoing " . $qpsmtpd{BccUser};
}
Save by pressing Ctrl x at the same time and confirm with y
Then enable the changes with
signal-event email-update
More info:
perldoc /usr/share/qpsmtpd/plugins/bcc
Set Helo hostname
Default is set to the hostname.domain, but sometime you might want to have something else to answer with the same as your reverseDNS. You can do one of the followings to only adjust the helo name:
config setprop smtpd HeloHost mydomainname signal-event email-update
or the following to adjust the way your server will present itself everywhere (httpd, qpsmtd...) This might trigger the generation of new ssl certificate, so use it only if you are sure this is what you want to do.
config set DomainName mydomainname signal-event domain-modify signal-event email-update
Set max email size
- IMPORTANT:
bugzilla: 7876points out that if your system has /var/service/qpsmtpd/config/databytes it should be deleted. (Fixed as of smeserver-qpsmtpd-2.4.0-7.el6.sme.noarch - seebugzilla: 8329).
There are several components involved in sending email on a SME server. Each component has a size limit that may affect an email message that passes through the server.
Be aware that email size is not the same thing as attachment size. Binary attachments to email are encoded using techniques that result in email sizes that can be as much as 30% larger than the original attachment. Most major email clients (Thunderbird, Apple Mail, Outlook) allow you to enable a "message size" column in the message list that will show you the size of your email messages (More).
| Subsystem | Function | Default Limit | Command to change size | Notes |
|---|---|---|---|---|
| qmail | Delivers email to local mailboxes and to remote servers | 15000000 | config setprop qmail MaxMessageSize xx000000 | Value is in BYTES. 15000000 equals approximately 15MB. No value means no limit. |
| clamav | Used to scan emails and attachments | 15M | config setprop clamav MaxFileSize 15M | Value includes human-readable abbreviations. "15M" equals 15 MegaBytes. |
| clamd | Involved in attachment virus scanning | 1400000000 | config setprop clamd MemLimit 1400000000 | May require increase per this forum topic |
| qpsmtpd | The clamav plugin to qpsmtpd is called with a specified size limit. | 25000000 | config setprop qpsmtpd MaxScannerSize xx000000 | Value is in BYTES. Question: does this value override the setting of 'MaxFileSize', or will the smaller value prevail? |
| php | The php maximum file upload size will determine the largest file you can attach to an email message using horde (or any other php email client) | 10M | config setprop php UploadMaxFilesize 10M |
clamav
A note about clamav:
ClamAV includes settings to prevent the scanning of archives that could cause problems if fully expanded; if an attachment cannot be scanned, it will be rejected.
In order for changes to take effect, run:
signal-event email-update
These attributes could result in the rejection of a compressed attachment on a SME server:
- ArchiveMaxCompressionRatio (default 300)
- MaxFiles (default 1500)
- MaxRecursion (default 8)
spamassassin
By default the qpsmtpd 'spamassassin' plugin does not pass any messages over 500,000 bytes to spamassassin for scanning.
To change this behavior:
db configuration setprop spamassassin MaxMessageSize 2000000
increases message size to 2,000,000 bytes. Apply the change with
signal-event email-update
Change Horde Webmail Login Page 'Welcome To' Title
The login page for Webmail defaults to "Welcome to Horde Webmail". In order to change this to something like "Welcome to MyDomain Mail"
config setprop horde Name "MyDomain Mail" signal-event email-update
See also:
Other configurable Horde settings DB_Variables Configuration#Horde_(webmail)
Forum post 31093
Add the admin user as an administrator for Horde
config setprop horde Administration enabled signal-event email-update
Large attachments not displaying in webmail
Due to limits set in the PHP configuration it might be that webmail will not display large attachments (see also bugzilla:3990). The following entries are related to the error and can be found in the log files:
/var/log/messages
Mar 13 00:00:12 box1 httpd: PHP Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 154 bytes) in /home/httpd/html/horde/imp/lib/MIME/Contents.php on line 173
/var/log/httpd/error_log
Allowed memory size of 33554432 bytes exhausted (tried to allocate 0 bytes)
The default MemoryLimit setting in PHP is set to 32M the value can be changed using the commands below replacing XX with the value you desire.
db configuration setprop php MemoryLimit XXM expand-template /etc/php.ini sv t httpd-e-smith
Disable mail to a user from an external network
However, this seems to only affect /var/qmail/control/badrcptto - denying external delivery to your users but allowing outbound emails: http://forums.contribs.org/index.php?topic=40449.5
Can be either a user, pseudonym or group
db accounts setprop groupname/username/pseudonym Visible internal signal-event email-update
If you want to remove
db accounts delprop groupname/username/pseudonym Visible signal-event email-update
- If you need to restrict emails for all users you can perform this command line
db accounts show | awk -F "=" '/\=user/ {print $1}' |while read USER; do db accounts setprop $USER Visible internal; done
signal-event email-update
If you want to remove
db accounts show | awk -F "=" '/\=user/ {print $1}' |while read USER; do db accounts delprop $USER Visible; done
signal-event email-update
I can't receive mail at: user@mail.domain.tld
Add mail.domain.tld as a virtualdomain.
-login to SERVER-MANAGER -click DOMAINS (on the left) -click ADD -type: mail.domain.tld
How do I find out who is logged into webmail and what IP number.
This is logged is in /var/log/messages.
Allow SMTP relay of mail without encryption/authentication
Change the configuration of the system from the default, so that it no longer requires encryption/authentication before allowing relaying of mail.
- For most case, you really want to allow few specific clients on your LAN or trusted networks, this is done by setting a coma separated list of ip this way (replace IP1, IP2, IP3 by valid ips).
config set qpsmtpd UnauthenticatedRelayClients IP1,IP2,IP3 signal-event email-update
- In some case you would have a whole dedicated network with appliances needing to send email without auth, this is done this way
db networks setprop {$network} RelayRequiresAuth disabled
signal-event email-update
- In case you needs are not fulfilled because you need to accommodate a list of remote IP or a sub network of a larger trusted network, you can create a custom template. Here for reference the accepted formats:
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients # a subnetwork by only using a prefix of full ip echo "10.10.0.">> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom # an external ip echo "99.10.1.23" >> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom # an external network you control echo "164.163.12.1/30" >> /etc/e-smith/templates-custom/var/service/qpsmtpd/config/relayclients/80custom signal-event email-update
- Disable smtp authentication on all local interfaces as shown in
Bugzilla: 6522
config setprop qpsmtpd RelayRequiresAuth disabled signal-event email-update
SMTP Authentication TLS before Auth disable & enable
Since SME v7.5 the default for SMTP Authentication is 'requires TLS before Auth' to increase security. Where a SME7.4 or earlier server with SMTP & SSMTP authentication enabled has been upgraded, users are now unable to send mail. Users will need to enable TLS or Auto for the Authentication encryption setting in their email clients. Some older email clients and devices do not support TLS.
A fix was released in SME7.5.1 to allow this setting to be disabled (ie revert to SME7.4 functionality). Upgrade to SME7.5.1 before using these commands.
To disable this (AUTH without TLS) & revert to SME7.4 defaults do
config setprop qpsmtpd TlsBeforeAuth 0 signal-event email-update
To change back to the sme7.5 & greater default (AUTH with TLS) do
config setprop qpsmtpd TlsBeforeAuth 1 signal-event email-update
See http://forums.contribs.org/index.php/topic,46218.0.html
http://bugs.contribs.org/show_bug.cgi?id=5997
Internet provider's outgoing port 25 is blocked: How to set an alternative outgoing port for the SMTP server
If your Internet provider is blocking outgoing smtp port 25 on your internet connection but your provider is offering an alternative outgoing port (or when using some relay service) you can simply set this alternative port by adding it to the 'Address of Internet provider's mail server' value in the 'E-mail delivery settings' screen of the server-manager like this:
<internet providers mail server name or ip-address>:<alternative port>
For example: mail.mydomain.com:587
This setting does not alter the incoming smtp mail server port on SME server, which will still use port 25. Refer to a workaround in http://wiki.contribs.org/PortRedirect
How do I enable and configure a disclaimer in email messages
A disclaimer message can be added to the footer of all outgoing email messages.
The message can be the same for all domains or it can be different for all domains.
This functionality is part of sme7.2 release so make sure you have upgraded before doing this.
To create a general disclaimer for all domains on your sme server
config setprop smtpd disclaimer enabled nano -w /service/qpsmtpd/config/disclaimer
Enter the required disclaimer text
To save & exit
Ctrl o Ctrl x
To make the changes take effect
signal-event email-update
To create domain specific disclaimers, create seperate domain based disclaimer text files
Delete the general (all domains) disclaimer file if you have already created it
rm /service/qpsmtpd/config/disclaimer config setprop smtpd disclaimer enabled nano -w /service/qpsmtpd/config/disclaimer_domain1.com.au nano -w /service/qpsmtpd/config/disclaimer_domain2.com nano -w /service/qpsmtpd/config/disclaimer_domain3.org
Enter the required text in each disclaimer file
To save & exit
Ctrl o Ctrl x
After making any changes remember to do
signal-event email-update
Note if you only wish to have a disclaimer for some domains, then only create a disclaimer text file for those domains
Note also the criteria for when a disclaimer is attached
(see http://bugs.contribs.org/show_bug.cgi?id=2648)
eg a disclaimer is added to internal to external messages but not internal to internal messages.
To disable the disclaimer function for all domains on your sme server
config setprop smtpd disclaimer disabled signal-event email-update
Email WBL server manager panel
There is a server-manager contrib to allow GUI control of email white and black lists, detailed in the wiki article: Email_Whitelist-Blacklist_Control.
The panel allows easy configuration of functionality that is built into qmail, qpsmtpd and spamassassin. For more information google for qmail & qpsmtpd, read the spamassassin section in this wiki article and see Email#Default_Plugin_Configuration default qpsmtpd plugin confguration).
There are two main sections, Blacklist and Whitelist, where you can control settings.
Note that there are subtle differences in syntax between whitelist and blacklist entries
Blacklist - Black lists are used for rejecting e-mail traffic
DNSBL status - DNSBL is an abbreviation for "DNS blacklist".
It is a list of IP addresses known to be spammers.
RHSBL status - RHSBL is an abbreviation for "Right Hand Side Blacklist".
It is a list of domain names known to be spammers.
qpsmtpd badhelo - Check a HELO message delivered from a connecting host.
Reject any that appear in badhelo during the 'helo' stage.
qmail badmailfrom - Check envelope sender addresses.
Reject any that appear (@host or user@host) in badmailfrom during the 'mail'
stage.
spamassassin blacklist_from - Any envelope sender of a mail (*@host or user@host) matching an
entry in blacklist_from will be rejected by spamassassin.
Whitelists - White lists are used for accepting e-mail traffic
Whitelists status - White Lists: ACCEPT
qpsmtpd whitelisthosts - Any IP address listed in whitelisthosts will be exempted
from any further validation during the 'connect' stage.
qpsmtpd whitelisthelo - Any host that issues a HELO matching an entry in whitelisthelo
will be exempted from further validation during the 'helo' stage.
qpsmtpd whitelistsenders - Any envelope sender of a mail (host or user@host) matching an
entry in whitelistsenders will be exempted from further validation
during the 'mail' stage.
spamassassin whitelist_from - Any envelope sender of a mail (*@host or user@host) matching an
entry in whitelist_from will be exempted from spamassassin rejection.
How to block email from one address to another address with check_badmailfromto plugin
Enable the check_badmailfromto plugin. Adapted from this Forum post
This is based heavily on the similar check_badmailfrom, but this plugin references both the FROM: and TO: lines, and if they both are present in the badmailfromto config file (a tab delimited list of FROM/TO pairs), then the message is blocked as if the recipient (TO) didn't exist. This is specifically designed to not give the impression that the sender is blocked (good for cases of harassment).
Prior SME9.2 : qpsmtpd check_badmailfromto plugin
To control mail from external locations to internal locations do
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0 mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins echo "check_badmailfromto" > /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto signal-event email-update
To control mail sent from internal locations to internal locations, in addition to the above also do
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto signal-event email-update
Since SME9.2 : qpsmtpd badmailfromto plugin
remove previous templates, if you are updating
rm /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31check_badmailfromto \ /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31check_badmailfromto \ /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31check_badmailfromto
To control mail from external locations to internal locations do
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0 mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins echo "badmailfromto" > /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/0/31badmailfromto signal-event email-update
To control mail sent from internal locations to internal locations, in addition to the above also do
mkdir -p /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local ln -s /etc/e-smith/templates-custom/var/service/qpsmtpd/config/plugins/31badmailfromto /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/31badmailfromto signal-event email-update
For Qmail
Create and configure the badmailfromto custom template fragment
mkdir -p /etc/e-smith/templates-custom/var/qmail/control/badmailfromto nano -w /etc/e-smith/templates-custom/var/qmail/control/badmailfromto/template-begin
Type in the From and To pairs that you want to stop email delivery for, with a tab between them and a carriage return at the end of the line, with additional pairs on a new line ie
user@bad-domain.com tab user@yourdomain.com enter user@bad-domain2 tab user2@yourdomain enter
Note also that wildcards or blank spaces are not supported
eg
john@aol.com mary@yourdomain bill@yahoo.com paul@yourdomain.com
then save using
Ctrl o Ctrl x
Expand the template to update the /var/qmail/control/badmailfromto config file
expand-template /var/qmail/control/badmailfromto
Restart mail services
signal-event email-update
Redirect mail.domain.net to Webmail
Setup external dns records
Add mail.domain.net in Domains panel in server-manager
db domains setprop mail.dom.ain TemplatePath ProxyPassVirtualHosts ProxyPassTarget http://sme.dom.ain/webmail signal-event remoteaccess-update
where http://sme.dom.ain/webmail is servername.domainname/webmail
E-mail Retrieval
http://wiki.contribs.org/SME_Server:Documentation:Administration_Manual:Chapter13#E-mail_Retrieval
If your ISP does not provide a custom sort field and you experience the following errors occuring when Multidrop is enabled and the "Select Sort Method (for multi-drop)" is set to Default:
fetchmail: warning: multidrop for pop3.mypopserver.com requires envelope option! fetchmail: warning: Do not ask for support if all mail goes to postmaster!
and/or
fetchmail: warning: multidrop for my.isp.domain requires envelope option! fetchmail: warning: Do not ask for support if all mail goes to postmaster!
Set "Select Sort Method (for multi-drop) to 'Received' or 'for'
As described at bugzilla:5602 bugzilla:6483
Domain Authentication
Major mail hosting companies (Google, Yahoo, Microsoft) have made domain-authentication mandatory so as to not mark incoming mail as spam.
To facilitate this support for DomainKeys and DKIM signing needs to be enabled in SME's mail subsystem. These techniques require the adding of records in the DNS zone for the user's domain. The DKIM/DK/SPF/SenderID configuration has to be added to your your DNS server / registrar.
How do I remove an email address from the everyone group
By default, all users are automatically added to the user group "everyone". If you would like to remove a user from this group, connect to the server using SSH or locally log in to the server and issue the commands below. Be sure to substitute the name of the user you want to remove for the word username.
db accounts setprop username EveryoneEmail no signal-event user-modify username
How do I remove an email address from any regular group
By default, all users member of a group "group1" are automatically added as recipients of mail sent to group1@domain. If you would like to remove a user from this group, connect to the server using SSH or locally log in to the server and issue the commands below. Be sure to substitute the name of the user you want to remove for the word username.
db accounts setprop group1 EmailExcludeUsers tom,jack signal-event group-modify group1
If you want to prevent all the user members from another group "group2" from receiving emails addressed to group1@domain while they are also member of group1, you could connect to the server using SSH or locally log in to the server and issue the commands below. Be sure to substitute the name of the user you want to remove for the word username.
db accounts setprop group1 EmailExcludeGroups group2 signal-event group-modify group1
All members of the group will still be member for all other purpose (samba access to ibays as an example)
This behaviour is only available as per e-smith-qmail-2.4.0-7.sme see bug #9540
Change the number of logs retained for qpsmtpd and/or sqpsmtpd
The normal retention is 5 logs for both qpsmptd and sqpsmtpd. This may or may not fit all installations. This information is pulled from bugzilla.
Check your config to see if any change has been made to the default log retention rules. Note there are different rules for qpsmtpd and sqpsmtpd. You have to make changes to both as you require.
config show qpsmtpd
If the KeepLogFiles property isn't listed, the default rules apply. Determine how many logs you would like to keep and apply that to the following example. In the command below, 15 is used to keep 15 qpsmtpd logs.
db configuration setprop qpsmtpd KeepLogFiles 15
Restart multilog with the following.
sv t /service/qpsmtpd/log
Check that your setting saved.
ps aux | grep qpsmtpd | grep multi
Look for the line that ends with /var/log/qpsmtpd and verify the number after n equals your KeepLogFiles property from above.
DKIM Setup - qpsmtpd version<0.96
A plugin has been written and is available in SME
To activate it manually follow the steps below, or download a shell script that will do the server based stuff for you & guide you on the DNS stuff setup_dkim.sh:-
Note: I'd recommend reviewing the script first to make sure you're happy to run it on your system
Create a folder:
mkdir /var/service/qpsmtpd/config/dkimkeys/
Then:
cd /var/service/qpsmtpd/config/dkimkeys/ openssl genrsa -out dkim.private 1024 openssl rsa -in dkim.private -pubout -out dkim.public chown qpsmtpd:qpsmtpd -R /var/service/qpsmtpd/config/dkimkeys/ chmod 0700 dkim.private
For each domain you want to sign:
cp -a dkim.private <fully qualified domain name>.private (less the <> brackets)
Then create a template fragment:
mkdir --parent /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local echo "dkim_sign keys dkim">/etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign signal-event email-update
Finally propagate your public key "dkim.public" content (<key text>) to your DNS.
Check with your DNS server / registrar. Something similar to the following should work but it varies depending on provider - replace <fully qualified domain name> with your doman details e.g "mydomain.org" (less the <> brackets):
When extracting the key text from the dkim.public file it's on multiple lines. For the key to work for us in the DNS TXT record we need to exclude the header & footer lines & have just the key text as a single line string (the setup_dkim.sh script provides this info in the format required).
default._domainkey.<fully qualified domain name> IN TXT "k=rsa; p=<key text>; t=y"
With Zonedit the following works within your Zone :
Subdomain : default._domainkey
Type : TXT
Text : "v=DKIM1;k=rsa; p=<key text>; t=y"
If you want to customize the signing you can add parameters to the line in /etc/e-smith/templates-custom/var/service/qpsmtpd/config/peers/local/69dkim_sign. Parameters and value are separated by a space only.
- keys : "dk" or "domainkeys" for domainkey signature only, "dkim" for DKIM signature only, default "both" (n.b. above template example is dkim ONLY)
- dk_method : for domainkey method , default "nofws"
- selector : the selector you want, default "default"
- algorithm : algorithm for DKIM signing, default "rsa-sha1"
- dkim_method : for DKIM, default "relaxed"
NB: key files can not be defined in parameters, they need to be in /var/service/qpsmtpd/config/dkimkeys/{SENDER_DOMAIN}.private
See also : bugzilla:8251 bugzilla:8252
DKIM Setup - qpsmtpd version >= 0.96
Version 0.96 and above supports DKIM natively without the need for extra plugins.
All you have to do is to enable the DKIM signing and promulgate the DNS TXT entries to support it.
Enable the signing:
db configuration setprop qpsmtpd DKIMSigning enabled signal-event email-update
and then run:
qpsmtpd-print-dns <domain name>
to show the DNS entry(s) required.
Then you have to update your DNS.
also see bugzilla:9694 and https://wikit.firewall-services.com/doku.php/smedev/qpsmtpd_096#documentation
More details are available here
Incoming DKIM checking is also enabled out of the box.
In case you got a problem using the DKIM field provided with your DNS provider /registrar, please first contact them to ensure the problem is not how you try to enter the information. In the likelihood, you got "invalid field" or "too long field" errors and your provider is not able to help you or update its interface, you can generate a shorter DKIM key (with 1024 instead of the default 2048) this way:
cd /home/e-smith/dkim_keys/default mv private private.long mv public public.long openssl genrsa -out private 1024 openssl rsa -in private -pubout -out public chown qpsmtpd:qpsmtpd private chown root:qpsmtpd public chmod 0400 private signal-event email-update qpsmtpd-print-dns
Outbound DKIM signing / SPF / DMARC policy FOR MULTIPLE DOMAINS
The default DKIM key is created in /home/e-smith/dkim_keys/default. To enable DKIM signing for all the domains that you manage:
db configuration setprop qpsmtpd DKIMSigning enabled signal-event email-update
If you want to disable dkim signing for a domain, you can use:
db domains setprop domain.com DKIMSigning disabled signal-event email-update
The default behavior is to use the same key pair for all your domains. But you can create other key pairs for specific domain if you want. For example, if you want to use a specific key pair for the domain.net domain:
cd /home/e-smith/dkim_keys mkdir domain.net cd domain.net echo default > selector openssl genrsa -out private 2048 openssl rsa -in private -out public -pubout chown qpsmtpd:qpsmtpd private chmod 400 private signal-event email-update
Now, the emails using a domain.net sender address will be signed by this new key instead of the default one.
Domain Keys
There is a plugin to check incoming mail has been signed
Please read here for more details : http://bugs.contribs.org/show_bug.cgi?id=4569
Other information
DomainKeys seem to be deprecated in favour of DKIM.
The DomainKeys plugin only CHECKS incoming email. Spamassassin checks for DKIM.
Temporary_error_on_maildir_delivery
In certains cases you have some mailboxes which can't delivery messages and the qmail log say:
deferral: Temporary_error_on_maildir_delivery._(#4.3.0)/
It is probably that your users want to go beyond the upper limit of their quota, so you have to increase it. This could solve their problems.
External Access
Allow external IMAP mail access
There was a deliberate decision to remove non-SSL protected username/password services from the external interface.
to allow unsecure IMAP access
config setprop imap access public signal-event email-update
But before you do this try to use secure IMAP (IMAPS or imap over ssl) with port 993
POP3 & webmail HTTP
I want to set my SMESERVER to allow POP3 (or webmail HTTP) but it's not an option, I only see POP3S (or webmail HTTPS).
The SMESERVER is secure by design. POP3 (or webmail HTTP) is viewed as inadequate security and removed as an option from a standard installation to encourage unknowing administrators to select the 'best practice' option -a secure connection with POP3S, IMAPS, or HTTPS.
You can still set your SMESERVER to allow POP3 settings by:
config setprop pop3 access public signal-event email-update
Allow external pop3 access
Email settings > POP3 server access in SME 7.1 server-manager allows only pop3s protocol for clients outside the LAN. Some email clients (eg The Bat! v3.98.4) won't allow pop3s connections to SME 7.1 because of ssl version conflict. Until this is sorted out, a workaround is to hack SME to allow regular pop3 on the external interface using the following commands.
config setprop pop3 access public signal-event email-update svc -t /service/pop3s
more information bugzilla:2620
Imap
Folders with a dot in name
Email folder names that have a period ('.') in the folder name, will be split into sub-folders. e.g. folder name 'www.contribs.org' is created as
www
contribs
org
Dovecot Idle_Notify
Poor battery consumption issues has been reported with K9-mail on recent Android systems. It is apparent one way of helping this is to modify the imap_idle_notify setting. The default is in Dovecot, and therefore on SME is 2 minutes.
K9 has an idle refresh of 24 mins but it seems with Dovecot defaults at 2 mins it causes lots of wake ups and battery drain.
This is configurable via a config db property.
Default on install
# config show dovecot dovecot=service Quotas=enabled status=enabled
Set dovecot Idle_Notify to 20 minutes
# config setprop dovecot Idle_Notify 20 # config show dovecot dovecot=service Idle_Notify=20 Quotas=enabled status=enabled
Expand template to update *.conf (can also issue a full reconfigure/reboot)
# expand-template /etc/dovecot/dovecot.conf # dovecot -a |grep imap_idle_notify_interval imap_idle_notify_interval = 20 mins
qpsmtpd
SME uses the qpsmtpd smtp daemon.
Official Description
qpsmtpd is a flexible smtpd daemon written in Perl. Apart from the core SMTP features, all functionality is implemented in small "extension plugins" using the easy to use object oriented plugin API.
qpsmtpd was originally written as a drop-in qmail-smtpd replacement, but now it also includes smtp forward, postfix, exim and maildir "backends".
qpsmtpd wiki: http://wiki.qpsmtpd.org
Log watching tool
qplogtail is a script to to monitor /var/log/qpsmtpd/current, see bugzilla:3418
Qpsmtpd for SME versions 9.1 and earlier
Default Plugin Configuration
SME uses the following qpsmtpd plugins to evaluate each incoming email.
SME maintains 2 distinct configurations: one for the 'local' networks (as defined in server-manager::Security::Local networks) and another for 'remote' networks (everyone else).
The default configuration of each plugin is indicated in the 'Default Status' column.
| Plugin | Purpose | Default Status |
|---|---|---|
| hosts_allow | Prohibit more than "InstancesPerIP" connections from any single host (change with 'config setprop smtpd InstancesPerIP'). Allow or deny connections according to the contents of /var/service/qpsmtpd/config/hosts_allow. See hosts_allow SVN code for more details. | enabled |
| peers | Allow different plugin configuration based on the sending computer's IP address. By default SME maintains different configurations for the local networks (in /var/service/qpsmtpd/config/peers/local) and for everyone else (in /var/service/qpsmtpd/config/peers/0) | enabled |
| logging/logterse | Allow greater logging detail using smaller log files. Optionally supports qplogsumm.pl to compile qpsmtpd statistics. | enabled |
| auth/auth_cvm_unix_local | Allow authenticated smtp relay | enabled (remote) disabled (local) |
| check_earlytalker | reject email from servers that talk out of turn | enabled (remote) disabled (local) |
| count_unrecognized_commands | reject email from servers that issue X invalid commands | enabled (remote) disabled (local) |
| bcc | bcc all email to a specific address for archiving | disabled |
| check_relay | Check to see if relaying is allowed (in case the recipient is not listed in one of SME's local domains) | enabled |
| check_norelay | Check to see if the sending server is specifically forbidden to relay through us. | enabled |
| require_resolvable_fromhost | Check that the domain listed in the sender's email address is resolvable | enabled (remote) disabled (local) |
| check_basicheaders | reject email that lacks either a From: or Date: header | enabled |
| rhsbl | Reject email if the sender's email domain has a reputation for disregarding smtp RFCs. | disabled (always disabled for local connections) |
| dnsbl | Reject email from hosts listed in your configured dnsbl servers | disabled |
| check_badmailfrom | Reject email where the sender address is listed in /var/service/qpsmtpd/config/badmailfrom | enabled |
| check_badrcptto_patterns | Reject email addressed to any address matching an expression listed in /var/service/qpsmtpd/config/badrcptto_patterns | enabled |
| check_badrcptto | Reject email addressed to any address listed in /var/service/qpsmtpd/config/badrcptto | enabled |
| check_spamhelo | Reject email from hosts that say 'helo ...' using a value in /var/service/qpsmtpd/config/badhelo | enabled |
| check_smtp_forward | If config show DelegateMailServer or db domains show <domainname> MailServer is set (telling SME to deliver email for all domains or just <domainname> to another server), check_smtp_forward will connect to the specified server and will reject the message outright if the internal mail server would also reject it. | disabled unless an internal mail server is configured. |
| check_goodrcptto | Accept email only if the recipient address matches an entry in /var/service/qpsmtpd/config/goodrcptto. For domains that are configured to use an internal mail server, the entire domain name will be added to .../goodrcptto. | enabled |
| rcpt_ok | Return 'OK' if none of the other host checks has returned 'DENY' (??) | enabled |
| pattern_filter | Reject email according to content patterns (??) | disabled |
| tnef2mime | Convert MS TNEF (winmail.dat) and uuencoded attachments to MIME | enabled |
| disclaimer | Add a configurable disclaimer to email messages | disabled |
| spamassassin | Check email using spamassassin, and optionally reject it completely if the score exceeds a configurable value. | disabled (always disabled for local connections) |
| virus/clamav | Scan incoming email with ClamAV | enabled |
| queue/qmail-queue | Deliver the incoming message to qmail for delivery. | enabled |
Qpsmtpd for SME versions 9.2 and Later
This section has been taken from the notes prepared by the dev who made the changes, the wiki is here.
Here is a list of the plugins in use, and a note of any changes that might have occurred:
- logterse: no change
- tls: no change
- auth_cvm_unix_local: no change
- check_earlytalker: renamed earlytalker
- count_unrecognized_commands: no change
- bcc: no change
- check_relay: renamed relay
- check_norelay: merged into the relay plugin
- require_resolvable_fromhost: renamed resolvable_fromhost
- check_basicheaders: renamed headers
- rhsbl: no change
- dnsbl: no change
- check_badmailfrom: renamed badmailfrom
- check_badrcptto_patterns: doesn't exist anymore, merged with badrcptto
- check_badrcptto: renamed badrcptto
- check_spamhelo: renamed helo
- check_smtp_forward: no change
- check_goodrcptto: no change
- rcpt_ok: no change
- pattern_filter: no change
- tnef2mime: no change
- spamassassin: no change
- clamav: no change
- qmail-queue: no change
Here is a section for each of the new plugins which are installed by default. The ones that have not changed are documented above.
Karma
The karma plugin tracks sender history. For each inbound email, various plugins can raise, or lower the "naughtiness" of the connection (eg, if SPF check passes, if the message is spammy etc...). For each host sending us email, the total number of connections, and the number of good and bad connections is recorded in a database. If a host as more bad than good connections in its history, emails will be rejected for 1 day. 3 settings are available for this plugin:
- Karma (enabled|disabled): Default value is disabled. Change to enabled to use the plugin
- KarmaNegative (integer): Default value is 2.
It's the delta between good and bad connection to consider the host naughty enough to block it for 1 day.
Eg, with a default value of two, a host can be considered naughty if it sent you 8 good emails and 10 bad ones - KarmaStrikes (integer): Default value is 3. This is the threshold for a single email to be considered good or bad.
Eg, with the default value of 3, an email needs at least 3 bad karmas (reaches -3) for the connection to be considered bad.
On the other side, 3 good karmas are needed for the connection to be considered good. Between the two, the connection is considered neutral
and won't be used in the history count
Example:
db configuration setprop qpsmtpd Karma enabled KarmaNegative 3 signal-event email-update
URIBL
The URIBL plugin works a bit like RHSBL, except that it checks domain names found in the body of the email. For each URI identified, the corresponding domain name can be submitted to a BL list (through DNS queries). Two settings are available:
- URIBL (enabled|disabled): Default is disabled. Set this to enabled to use the plugin
- UBLList: (Comma separated list addresses): Default value is multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net.
This can be the same as RBLList. You can also set bitmask to use for combined lists (in the default value, the bitmask is 8-16-64-128)
Example:
db configuration setprop qpsmtpd URIBL enabled UBLList multi.surbl.org,black.uribl.com signal-event email-update
Helo
Previously, the helo plugin was just checking for some known bad helo hostnames used by spammers (aol.com and yahoo.com). Now, it can check much more than that. This plugin is always enabled and has a single setting:
- HeloPolicy: (lenient|rfc|strict). The default value is lenient.
See https://github.com/smtpd/qpsmtpd/blob/master/plugins/helo for a description of the various tests done at each level
Example:
db configuration setprop qpsmtpd HeloPolicy rfc signal-event email-update
Inbound DKIM / SPF / DMARC
DMARC is a policy on top of DKIM and SPF. By default, SPF and DKIM are now checked on every inbound emails, but no reject is attempted. The dmarc plugin can decide to reject the email (depending on the sender policy). dkim and spf plugins are always enabled. dmarc has two settings:
- DMARCReject (enabled|disabled): Default value is disabled.
If set to enabled, the dmarc plugin can decide to reject an email (if the policy of the sender is to reject on alignment failure) - DMARCReporting (enabled|disabled): Default value is enabled.
If set to enabled, enable reporting (which is the r in dmarc). Reporting is a very important part of the DMARC standard.
When enabled, you'll record information about email you receive from domains which have published a DMARC policy in a local
SQLite database (/var/lib/qpsmtpd/dmarc/reports.sqlite).
Then, once a day, you send the aggregate reports to the domain owner so they have feedback.
You can set this to disabled if you want to disable this feature - SPFRejectPolicy (0|1|2|3|4): Default value is 0. Set the policy to apply in case of SPF failure when the sender hasn't published a DMARC policy.
Note: this is only used when no DMARC policy is published by the sender.
If there's a DMARC policy, even a "p=none" one (meaning no reject), then the email won't be rejected, even on failed SPF tests.
- 0: do not reject anything
- 1: reject when SPF says fail
- 2: reject when SPF says softfail
- 3: reject when SPF says neutral
- 4: reject when an error occurred (like a syntax error in SPF entry) or if no SPF entry is published
- Inbound DKIM checks are only used by DMARC. No reject solely based on DKIM is supported
Example:
db configuration setprop qpsmtpd DMARCReject disabled SPFRejectPolicy 2 signal-event email-update
Outbound DKIM signing / SPF / DMARC policy
Everything is now ready for you to sign your outbound emails, and publish your public key, as well as your SPF and DMARC policy. A default DKIM key is created in /home/e-smith/dkim_keys/default. To enable DKIM signing for all the domain you manage:
db configuration setprop qpsmtpd DKIMSigning enabled signal-event email-update
If you want to disable dkim signing for a domain, you can use:
db domains setprop domain.com DKIMSigning disabled signal-event email-update
The default behavior is to use the same key pair for all your domains. But you can create other key pairs for specific domain if you want. For example, if you want to use a specific key pair for the domain.net domain:
cd /home/e-smith/dkim_keys mkdir domain.net cd domain.net echo default > selector openssl genrsa -out private 2048 openssl rsa -in private -out public -pubout chown qpsmtpd:qpsmtpd private chmod 400 private signal-event email-update
Now, the emails using a domain.net sender address will be signed by this new key instead of the default one.
Publishing your DNS entries
Signing your outbound emails is just part of the process. You now need to publish some DNS entries so everyone can check if the email they receive matches your policy. This part is not to be done on your SME Server, but on your public DNS provider. A script helps you by creating some sample DNS entries already formatted for a bind-like zone file. To use it:
qpsmtpd-print-dns <domain name>
If omitted, the primary domain name is assumed.
Example output:
Here are sample DNS entries you should add in your public DNS The DKIM entry can be copied as is, but others will probably need to be adjusted to your need. For example, you should either change the reporting email adress for DMARC (or create the needed pseudonym) default._domainkey IN TXT "v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs/Qq3Ntpx2QNdRxGKMeKc2r9ULvyYW633IbLivHznN9JvjJIbS54PGIEk3sSxvZSdpTRAvYlxn/nRi329VmcDK0vJYb2ut2rnZ3VO3r5srm+XEvTNPxij5eU4gqw+5ayySDjqzAMEMc5V7lUMpZ/YiqnscA075XiMF7iEq8Quv1y0LokmgwtxzOXEZap34WXlKyhYzH+D""fabF6SUllmA0ovODNvudzvEOanPlViQ7q7d+Mc3b7X/fzgJfh5P9f5U+iSmzgyGctSb6GX8sqsDMNVEsRZpSE3jd2Z33RDWyW21PGOKB/ZrLiliKfdJbd3Wo7AN7bWsZpQsei2Hsv1niQIDAQAB" @ IN SPF "v=spf1 mx a -all" @ IN TXT "v=spf1 mx a -all" _dmarc IN TXT "v=DMARC1; p=none; adkim=s; aspf=r; rua=mailto:dmarc-feedback@domain.net; pct=100"
All you have to do now is publish those records, but do note that there is a point to consider when publishing the default._domainkey DNS record, as produced by the qpsmtpd-print-dns command: if the DNS record includes ;t=y then as per the DKIM specification (RFC4781 section 3.6.1) this means that your "...domain is testing DKIM. Verifiers MUST NOT treat messages from signers in testing mode differently from unsigned email, even should the signature fail to verify. Verifiers MAY wish to track testing mode results to assist the signer."
On the other hand, if no ;t=y is included, then it means you are intending to use DKIM in production mode. It might be a good idea to publish the DKIM DNS record first in testing mode (;t=y included), check how things go and if everything is alright, remove the ;t=y part.
Testing
You can install spfquery:
yum --enablerepo=epel install libspf2 libspf2-progs
Usage (try -help for help):
spfquery -ip=11.22.33.44 -sender=user@aol.com -helo=spammer.tld
Check record via dig
dig -t TXT +short somedomain.co.uk
Load
The loadcheck plugin can temporarily deny inbound emails if your server is overloaded. This plugin is always enabled and has a single setting:
- MaxLoad (int number): Default is 7. If your load is above this value, emails from the outside will be deferred.
Other QPSMTPD Plugins
The following qpsmtpd plugins will work on a SME server, but are either not included or are not configured by default.
| Plugin | Purpose | Default Status |
|---|---|---|
| connection_time | Track the total time for each qpsmtpd connection from 'Accepted connection' through 'click, disconnecting', and output the results to the qpsmtpd log file. | not installed - not clear if this works for SME9.2 (anyone?) |
| GeoIP | Track the geographic origin of incoming email and optionally reject email from specified countries | not installed - does work for SME 9.2 and later. |
Internal or External Mail Servers
SME can be configured as a spam and antivirus filter for one or more "Internal or External" mail servers on a domain-by-domain basis. The mail server specified does not have to be on the same local network as your SME server, & can be hosted on an external site.
Deliver ALL email to a single internal or external mail server
You can set the default delivery location for all domains on your SME server to a single internal or external mail server by setting the mail server address in server-manager::Configuration::E-mail::Change e-mail delivery settings::Address of internal mail server.
Note: Address of internal mail server must be blank if you want any email delivered to the SME server itself.
Deliver email for one domain to an internal or external mail server
You can override the default email delivery destination for individual domains on your SME server (forwarding all email for the specified domain to another server) as follows:
First, create the necessary virtual domains using server-manager::Configuration::Domains::Add Domain.
Then, (assuming your domain is called test.com and the actual mail server is at a.b.c.d issue the following commands:
db domains setprop test.com MailServer a.b.c.d signal-event email-update
A FQDN can also be used for the MailServer property, eg aspmx.l.google.com instead of the IP address a.b.c.d
db domains setprop test.com MailServer aspmx.l.google.com signal-event email-update
Remove the internal or external mail server (and return email delivery for test.com to the default for your SME server) using:
db domains delprop test.com MailServer signal-event email-update
Secondary/Backup Mail Server Considerations
Many people misunderstand the issues of using a secondary or backup mail server (backup MX) to hold your mail before it gets delivered to your SME Server. If you consider putting a backup mail server in place because you are concerned about lost mail because your internet connection may occasionally drop out, think again and consider the issues discussed below.
What is Backup MX
A backup MX is a system whereby through your DNS records you tell other servers on the internet that in order to deliver mail to your domain they first need to try the primary MX record and if they fail to connect they can try to connect to one or more of your listed backup or secondary mail servers. See also http://en.wikipedia.org/wiki/MX_record
The process of delivering email to your SME Server
So lets look at how mail gets delivered without and with a backup mx when your Internet link, ISP or server is down.
Without a backup MX
- The sending mail server cannot connect to your server.
- The sending mail server MUST queue the mail and try again later.
- The mail stays on the sender's server.
- The sender's server resends the mail at a later date.
The requirement to re-queue is a fundamental part of the SMTP protocol - it is not optional. So, if your server is offline due to a link or ISP outage, the mail just stays at the sender's server until you are once again reachable.
With a backup MX
- The sending mail server cannot contact your server.
- The sending mail server sends the mail to your secondary MX.
- The secondary MX queues the mail until your link/server is up.
- The mail is queued on an untrusted third-party mail server (think about confidential mail between your company and some business partner).
- The sending mail server's administrator thinks it has been delivered, according to their logs.
- You have no, or little, visibility over the queued mail.
- When your link comes up, the secondary MX sends the mail on to your server.
- You have added more hops, more systems and more delay to the process.
If you think that a backup MX will protect against broken mail servers which don't re-queue, you can't. Those servers will drop mail on the floor at random times, for example when their Internet link is down.
Those servers are also highly likely to never try your backup MX.
Thankfully those servers are mostly gone from the Internet, but adding a secondary MX doesn't really improve the chances that they won't drop mail destined for your server on the floor.
Backup MX and SPAM Filtering
On top of the issue, indicated above, there is another issue to consider and that is what happens with SPAM due to the use of a Backup MX.
Your SME Server takes care of filtering a lot of SPAM by checking on the full username & domain at the time it is received.
For example if your server hosts example.com and someone sends mail to joeuser@example.com, the server will only accept the mail if joeuser is a local user/alias/group/pseudonym on the server. Otherwise, the mail is rejected during the SMTP transaction.
A backup mail server however, generally does not have a full list of users against which it can check if it should accept the mail for the given domain. Hence it will accept mail for invalid users.
So:
- If you trust the secondary MX, you will accept a lot of SPAM when the link comes up.
- If you don't trust it, you will cause a lot of SPAM backscatter as the mail has been accepted at the secondary MX and then later bounced by you.
- Stopping backscatter is why SME Server rejects invalid addresses during the initial SMTP transaction.
The SPAM backscatter can only be stopped if the secondary MX has a full list of users for your domain to allow filtering to occur.
But:
- You need to be able to configure this secondary MX with such user/domain lists
- You need to maintain these secondary configurations when users are added/deleted from your primary server configuration
- You need to test (regularly) if the secondary is successfully accepting/rejecting mail as required.
Quite a few sites have lost lots of mail through misconfigured backup MX servers. Unfortunately, the time when you find out they are misconfigured is when you go to use them, and then you find that the backup MX has changed configuration and bounced all of your mail.
Then you realise that this mail could have queued at the sender's site if there hadn't been a broken secondary MX bouncing the mail for you.
- If you bounce mail at your server, you have logs to show what's wrong.
- If your secondary MX bounces your mail, you usually have no way to determine what happened other than via reports from the original senders that your mail bounced.
Summary
In summary, if your server/Internet connection is available most (let's say >90%) of the time, you are generally better off without a secondary MX.
If your server/link is down more than this (e.g. dialup), you should not be delivering mail directly to your server.
If you still want to consider setting up a seconday MX, ensure that:
- you have fully control of the configuration of each of the email gateways for your domain
- each gateway can make decisions on whether to accept/reject mail for the users at the domain
Mail server on dynamic IP
Problems with running a mail server on SME server using a dynamic external IP from ISP
This information comes from http://bugs.contribs.org/show_bug.cgi?id=2057#c10
This is the chronological sequence of events that leads to issues with mail servers on dynamic IPs:
1) Server gets dynamic IP
2) Reboot/power fail (without updating dynamic DNS to "offline")
3) Another server/someone else is allocated your old IP while your server is down
4) The other server/person is running a mail server
5) The other server either gets your mail (which is bad) or bounces your mail (also bad)
You have no control over this issue and you will lose mail when it happens. If you have a dynamic IP, the recommended approach is to get someone with a static IP to queue your inbound mail and send it to you on a non-standard port, preferably with an authentication mechanism which queues the mail if the auth fails, just in case someone else happens to have a mail server on the same port (while highly unlikely, this is possible).
Whether this issue is really a problem to end users, depends on how much you "value" your mail. For a home user having their own mail server, it is probably not a great problem if some messages should happen to go astray, but for all other classes of users, you should really avoid running a mail server on a dynamic IP, without implementing a suitable queueing workaround as suggested. Some ISPs change the IP very infrequently eg yearly, so in those cases it is also not a significant problem. Many/most ISP's will issue a new IP every time a connection is lost & re-established, so these situations are more problematic.
How to re-apply procmail rules
If you have a folder of email that needs to have the procmail rules applied, then the trick is to be logged in as the email user, and then position your self in the home directory, and then this works:
su <username> -s /bin/bash cd ~ for m in <fullpath to maildirectory>/cur/*; do echo $m; procmail < $m && rm $m; done
Is this article helpful to you?
Please consider donating or volunteering
Thank you!
The server manager is the GUI front end for the firewall. The firewall is modified automatically in response to changes you make in the configuration, such as enabling/disabling services, marking them public/private, forwarding ports, etc.
If you wish to make changes beyond those provided for by the server manager, you can do so by setting DB records or providing custom templates. Only make these changes if you are sure you know what you are doing, incorrect settings will compromise security on your server.
FAQs
- I want to have two WAN addresses; one for the SMESERVER and another that needs to be treated like a "Local Network". I can't set any address from the WAN subnet as a "Local Network".
This is intended behaviour as SMESERVER is secure by design. If you need to do something like this, you should know what you are doing and understand what to poke under the covers.
DB Settings
- How do I allow public access to a service I've added to SME Server?
For this example the service you have installed is called 'manta' and 'nnn' is the TCP port number that needs to be opened. Watch your capitalization with the command below:
config set manta service access public status enabled TCPPort nnn
For UDP services, use UDPPort instead of TCPPort.
If you need to open multiple ports for one service you can use TCPPorts and UDPPorts. Port numbers are seperated with a comma, but without a space. Note that ranges of ports are defined with a : between the numbers in this case, instead of a -.
Note that you can also set restrictions with AllowHosts and DenyHosts:
config setprop manta AllowHosts 1.2.3.4,10.11.12.0/24 config setprop manta DenyHosts 16.17.18.18
Then, to activate, do:
signal-event remoteaccess-update
- I want to block traffic from some ip-addresses to my server on some port.
config setprop httpd-e-smith DenyHosts a.b.c.d,w.x.y.z signal-event post-upgrade signal-event reboot
Additional information on customizing iptables
Create a custom-named service definition in the configuration database. you can see the DB configuration
db configuration set <servicename> service
Apply your desired firewall restrictions to any existing SME 'service' or to a custom-named service that you have created. Combine a custom-named service with port-forwarding to create customized firewall rules.
db configuration setprop <servicename> TCPPort <portnumber> db configuration setprop <servicename> TCPPorts <portnumbers> db configuration setprop <servicename> UDPPort <portnumber> db configuration setprop <servicename> UDPPorts <portnumbers> db configuration setprop <servicename> status enabled|disabled db configuration setprop <servicename> access public|private db configuration setprop <servicename> AllowHosts a.b.c.d,x.y.z.0/24 db configuration setprop <servicename> DenyHosts e.f.g.h,l.m.n.0/24
Effectuate the changes you have made
signal-event remoteaccess-update
| Variable | Target | Default | Expected values |
|---|---|---|---|
| TCPPort | --proto tcp --dport <Ports> | Pre-configured for default services; no default for custom services | empty or a numerical or coma separated numbers |
| TCPPorts | --proto tcp --dports <Ports> | No default for custom services; Ranges of ports are defined with a : not a - | empty or a numerical or coma separated numbers |
| UDPPort | --proto udp --dport <Ports> | Pre-configured for default services; no default for custom services | empty or a numerical or coma separated numbers |
| UDPPorts | --proto udp --dports <Ports> | No default for custom services; Ranges of ports are defined with a : not a - | empty or a numerical or coma separated numbers |
| status | disabled | AllowHosts is set to "" (an empty string) unless the status is 'enabled' | 'enabled' or 'disabled' |
| access | private | AllowHosts is set to "" (an empty string) unless access is 'public' | 'private' for localhost and local network only (Server and gateway mode), 'public' for everywhere, 'localhost' for localhost only |
| AllowHosts | --src ..... --jump ACCEPT | Pre-configured for default services; no default for custom services. Default is '0.0.0.0/0' if service is enabled and public. | IP and netmask with this format 0.0.0.0/0, or coma separated list of these elements |
| DenyHosts | --src ..... --jump denylog | Pre-configured for default services; no default for custom services. If 'DenyHosts' is empty or does not exist then there are no '... --jump denylog' entries created in /etc/init.d/masq. | IP and netmask with this format 0.0.0.0/0, or coma separated list of these elements |
Custom templates
Block incoming IP address
- I want to block All traffic from some ip-addresses to my server.
Manual Method
Create a custom template and list the IP's
mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/ nano -w /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/40DenyRiffRaff
Now add the IP's you wish to block to the newly create file in the following format.
/sbin/iptables -A INPUT -s 69.212.12.76/32 -j DROP /sbin/iptables -A INPUT -s 88.28.215.11/32 -j DROP
expand and restart
/sbin/e-smith/expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart
To check the new block use the following command and look for the IP address you just DROP'ed. It should be listed in the "source" column.
iptables -L INPUT -v -n
Automated method
The above can be automated slightly.
First lets create a key where we can add IPs that we want to block:
config set ipblock configuration status enabled DenyHosts 208.100.26.0/24 logging disabled
As above, create the following template:
mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/ nano -w /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/40DenyRiffRaff
Paste this code:
{
use esmith::ConfigDB;
my $db = esmith::ConfigDB->open_ro
|| die 'Could not open configuration database';
# Completely block any riff raff
if ( ( my $status = $db->get_prop( 'ipblock', 'status' ) ) eq 'enabled' )
{
my $DenyHosts = $db->get_prop( 'ipblock', 'DenyHosts' ) || '';
if ( $DenyHosts ne '' ) {
my $logging = $db->get_prop( 'ipblock', 'logging' ) || 'disabled';
foreach my $host ( split( ',', $DenyHosts ) ) {
$OUT .= "\n";
$OUT .= "# Simple ipblock for riff raff\n\n";
if ( $logging eq 'enabled' ) {
$OUT .= "/sbin/iptables -A INPUT -s $host -j denylog\n";
}
else {
$OUT .= "/sbin/iptables -A INPUT -s $host -j DROP\n";
}
}
$OUT .= "\n";
}
else {
$OUT .= "# ipblock no DenyHosts set\n";
}
}
else {
$OUT .= "# ipblock disabled\n";
}
}
You can add multiple addresses separated by commas:
config setprop ipblock DenyHosts 208.100.26.0/24,1.2.3.4,5.6.0.0/16
You can disable this blocking with:
config setprop ipblock status disabled
If you want to log the dropped packets rather than just drop them:
config setprop ipblock logging enabled
Then expand and restart your firewall:
/sbin/e-smith/expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart
Block outgoing IPs or mac addresses
This section needs improvement.
See this forum post for clues re doing this, based in part on the concept of blocking incming traffic from specific external IPs.
http://forums.contribs.org/index.php/topic,46036.0/all.html
Formulation of suitable iptables rules will be required, use
man iptables
The template fragment needs to be placed in the right order, so that other rules do not negate the rule eg
20blockIP
Example: To block access based on the mac address of the NIC of the wokstation (not on IP)
mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/ pico -w /etc/e-smith/templates-custom/etc/rc.d/init.d/masq/20Blockmac
Add the following code to the fragment and save
/sbin/iptables -A INPUT -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP
(Replace XX.XX.XX.XX.XX.XX with actual mac address)
expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart
Check that blocking works as expected
To see the iptables that are in effect on your server, issue the command
iptables --list
or
iptables -L
Block outgoing ports
- I want to block outgoing traffic from my server.
These commands are based on http://bugs.contribs.org/show_bug.cgi?id=2977
Please check for the latest attachments (custom template fragments) to this bug.
At present, traffic is only blocked if it originates on the primary local network. No processing is performed on traffic addressed to the LAN IP, WAN IP or loopback address of the SME.
Download custom templates and configure ports with db command
mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq cd /etc/e-smith/templates-custom/etc/rc.d/init.d/masq wget -O 91adjustPortBlocks http://bugs.contribs.org/attachment.cgi?id=1395 wget -O 42SetupPortBlocks http://bugs.contribs.org/attachment.cgi?id=1389
Create desired db entries to suit the ports & protocols you want to block
config setprop masq TCPBlocks address:port config setprop masq UDPBlocks address:port
eg to block all outbound traffic except that passed by the smtp & httpd proxies
config setprop masq TCPBlocks 0.0.0.0/0:1-65535 config setprop masq UDPBlocks 0.0.0.0/0:1-65535
eg to leave open some ports ie 222 & 2000-2010, block in ranges
config setprop masq TCPBlocks 0.0.0.0/0:1-221,0.0.0.0/0:223-1999,0.0.0.0/0:2011-65535
Update the config changes and restart masq
signal-event remoteaccess-update /etc/init.d/masq restart
Bypass Proxy
- You have Transparent Proxy enabled (the default) but want to allow this to be selectively bypassed.
These commands are based on http://bugs.contribs.org/show_bug.cgi?id=2374
Please check for the latest attachments (custom template fragments) to this bug.
Download custom templates and configure ports with db command
mkdir -p /etc/e-smith/templates-custom/etc/rc.d/init.d/masq cd /etc/e-smith/templates-custom/etc/rc.d/init.d/masq wget -O 35transproxy http://bugs.contribs.org/attachment.cgi?id=1410 wget -O 90adjustTransProxy http://bugs.contribs.org/attachment.cgi?id=2178
Create desired db entries for the clients or sites you want to allow
config setprop squid BypassProxyTo 162.23.23.125 config setprop squid BypassProxyFrom a.b.c.d,x.y.z.0/0 expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart
If the setting changes do not appear to take effect, do the following
signal-event reboot
To add a BypassProxyFrom IP & retain existing IPs without re-entering them, do the following
config setprop squid BypassProxyFrom a.b.c.d,$(config getprop squid BypassProxyFrom) expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart
Followed if necessary by
signal-event reboot
To remove a specific entry but leave other existing entries unchanged
config setprop squid BypassProxyFrom \ $(config getprop squid BypassProxyFrom | \ sed -e 's/entry-to-be-removed//' -e 's/^,//' -e 's/,$//' -e 's/,,//')
where entry-to-be-removed is the IP to be removed
Note: The first sed is to remove the entry, the last second is to remove the comma at the beginning, the second for a comma at the end and the last to remove the double comma when an entry is removed at the middle of the list.
Disable bypass:
config delprop squid BypassProxyFrom config delprop squid BypassProxyTo expand-template /etc/rc.d/init.d/masq service masq restart signal-event reboot
Open Ports in Private Server/Gateway Mode
- I want to hide all ports, so I put my SMESERVER in PRIVATE SERVER/GATEWAY mode. I can still see some ports are open.
Certain services are still open on the WAN interface in PRIVATE SERVER/GATEWAY mode. Those services can be set to absolute private from the command line by:
config setprop masq Stealth yes config setprop ftp access private config setprop smtpd access private config setprop dnscache access private config setprop httpd-e-smith access private config setprop oidentd access private config setprop modSSL access private config setprop ssmtpd access private config setprop sshd access private config setprop imaps access private config setprop ldap access private config setprop pop3 access private config setprop pop3s access private config setprop nmbd access private config setprop smbd access private signal-event post-upgrade signal-event reboot
SME Server up to and including version 9.x runs MySQL as a database server.
SME Server 10 uses MariaDB to provide this function. A lot of applications require a MySQL database, among them is the Horde webmail interface which is supplied by SME Server by default.
- MySQL website: http://www.mysql.com
- MySQL 4.1 manual: http://dev.mysql.com/doc/refman/4.1/en/
- MariaDB documentation: https://mariadb.org/documentation/
General
The SME Server is based on CentOS, the development team will take their stock RPM's from the CentOS releases. The current version of MariaDB installed on SME Server is version 5.5.68.You can upgrade MariaDB, using their rpms, to a higher version but you are advised not to do so, as this might break your SME Server configuration. The Horde webmail interface relies on MariaDB. Upgrading to version 10.x has potential to break stuff like webmail. If you insist on upgrading MariaDB you may be able to find instructions in the forum, but be advised that no support can be expected from the developers and all bugs reported in the bugtracker will not be taken into account.
Alternatively you can rely on contribs and Red-Hat Software collection to add MySQL 5.7 and MariaDB 10.1 10.2 10.3 or 10.5 as secondary SQL service to satisfy your needs.
MariaDB on SME Server runs on a socket instead of on a port which you might be accustomed to. This is done to improve security as in the view of the development team only the server itself (localhost) needs to have access to the MySQL server. However you can configure MySQL to be accessible from the local network (see below).
[mysqld] [mysqld_safe] [mysql-5.7] [mariadb-10.1] [mariadb-10.2] [mariadb-10.3] [mariadb-10.5]
Access to MariaDB/MySQL from my application
As stated above on SME Server you have to use socket, this is more secure than using port. By default the service only listen on the server using socket, so trying to connect with any port will result in a failure.
Most application will have to define a string to access the socket, as below pointing to localhost (not 127.0.0.1, nor the LAN ip) and the full path to the socket. In some situation you will have to define the socket path and the host (localhost again and not 127.0.0.1) in variables.
define( 'DB_HOST', 'localhost:/var/lib/mysql/mysql.sock' );
MariaDB/MySQL root password
There appears to be no password set for the MySQL root password, but this is not true. If you are logged in to the SME Server shell a special mechanism is in place to log you in with MySQL root privileges without prompting you for the password.
The MySQL root password for SME Server is a 72 character random string generated during installation of SME Server. You should never change the MySQL root password as this will break your SME Server configuration. How to login as MySQL root user? describes how to access MySQL with root privileges on SME Server.
Login as MySQL root user
To login as MySQL root user, simply type 'mysql' at the SME Server shell, this will log you in with root privileges.
Resetting the MySQL root password
To reset the password for the MySQL root account. The MySQL root user on SME Server has a random generated password which is generated during installation. You do not need to know this password to login to MySQL with root privileges on SME Server. If you might have changed the MySQL root password you can reset it like this after getting command line access as root user.
systemctl stop mariadb expand-template /root/.my.cnf expand-template /var/lib/mysql/set.password /usr/libexec/mysqld --socket=/var/lib/mysql/mysql.sock --bootstrap --user=mysql --skip-grant-tables < /var/lib/mysql/set.password exit systemctl start mariadb
cd /var/service/mysqld sv d . expand-template /root/.my.cnf expand-template /var/service/mysqld/set.password /usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < ./set.password sv u .
For SME Server 7.2 and earlier releases do the following (they use the runsvctrl command instead of the sv command):
cd /var/service/mysqld runsvctrl d . expand-template /root/.my.cnf expand-template /var/service/mysqld/set.password /usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < ./set.password runsvctrl u .
Restoring accidentally deleted MySQL root user
mariadb 5.5 and up to 10.5 systemctl stop mariadb echo "GRANT ALL PRIVILEGES ON *.* TO 'root'@'`config get DomainName`' WITH GRANT OPTION;">/var/lib/mysql/set.rootuser echo "GRANT PROXY ON @ TO 'root'@'`config get DomainName`' WITH GRANT OPTION;">>/var/lib/mysql/set.rootuser echo "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;">>/var/lib/mysql/set.rootuser echo "GRANT PROXY ON @ TO 'root'@'localhost' WITH GRANT OPTION;">>/var/lib/mysql/set.rootuser expand-template /root/.my.cnf expand-template /var/lib/mysql/set.password /usr/libexec/mysqld --socket=/var/lib/mysql/mysql.sock --bootstrap --user=mysql --skip-grant-tables <( cat /var/lib/mysql/set.rootuser /var/lib/mysql/set.password) exit systemctl start mariadb
for MySQL 5.1.73
cd /var/service/mysqld
sv d .
echo 'use mysql;'>set.rootuser
echo "INSERT INTO `user` VALUES ('localhost','root',,'Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y',,,,,0,0,0,0);">>set.rootuser
expand-template /root/.my.cnf
expand-template /var/service/mysqld/set.password
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.rootuser
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.password
sv u .
Note: The following is only applicable on SME 7.3 and MySQL 4.1
cd /var/service/mysqld
sv d .
echo 'use mysql;'>set.rootuser
echo -n 'INSERT INTO user VALUES("localhost","root","",'>>set.rootuser
echo '"Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","Y","","","","",0,0,0);'>>set.rootuser
expand-template /root/.my.cnf
expand-template /var/service/mysqld/set.password
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.rootuser
/usr/libexec/mysqld --bootstrap --user=mysql --skip-grant-tables < set.password
sv u .
MariaDB/MySQL fails to start
you need to investigate the cause by inspecting two logs :
- service log
journalctl -u mariadb
- mariadb log
tail -f /var/log/mariadb/mariadb.log
Corrupted user table
Your error in mariadb log will include
ERROR: 130 Incorrect file format 'user'
This could mostly occurs after a power outage. mysql.user table is a MYSIAM type
# ll /var/lib/mysql/mysql/user.* -rw-rw---- 1 mysql mysql 10630 3 jui 21:08 /var/lib/mysql/mysql/user.frm -rw-rw---- 1 mysql mysql 488 3 jui 21:08 /var/lib/mysql/mysql/user.MYD -rw-rw---- 1 mysql mysql 2048 3 jui 21:08 /var/lib/mysql/mysql/user.MYI
In this case you might see user.MYD or user.MYI with 0 byte size. If the issue is on MYI this is the index you should be able to rebuild, if it is on the MYD, this is the data, you will need a backup to restore from.
as root, first start mariadb without grant table
systemctl stop mariadb /usr/libexec/mysqld --defaults-file=/etc/my.cnf --basedir=/usr --datadir=/var/lib/mysql --user=mysql --skip-grant-tables
then use mysql command line
mysqlcheck mysql
if wound any error try
mysqlcheck mysql --repair
if it fails then you needs to do a restore. You might have a dump in /home/e-smith/db/mysql/mysql.dump. Wishing it is up to date. I suggest you to copy it and just extract the part for the table you are missing. You need what is under
-- -- Table structure for table `user` --
and
-- -- Dumping data for table `user` --
Considering your table dump is now in a file called /home/e-smith/db/mysql/mysql.user.dump, do
mysql mysql < /home/e-smith/db/mysql/mysql.user.dump expand-template /var/lib/mysql/set.password mysql mysql < /var/lib/mysql/set.password mysqladmin shutdown systemctl start mariadb
Access MariaDB/MySQL using port from the localhost and local network
MariaDB/MySQL on SME Server runs on a socket instead of on a port. MariaDB/MySQL on SME Server is by default configured to allow only localhost connections to improve security, this means that it is only accessible from the server itself and not from the local network nor from the internet. If you wish to enable local network access, execute the following commands on a SME Server shell as root (note access private is not needed as this is the default, and TCPPort 3306 neither as all ports are open to the LAN by default):
config setprop mariadb LocalNetworkingOnly no expand-template /etc/my.cnf systemctl restart /service/mysqld
config setprop mysqld LocalNetworkingOnly no expand-template /etc/my.cnf sv t /service/mysqld
Access MySQL from a remote network
If you wish to enable access to MariaDB/MySQL databases from remote networks, then in addition to the LocalNetworkingOnly db setting mentioned above, you will need to execute the following commands:
config set mariadb service access public status enabled TCPPort 3306 signal-event remoteaccess-update signal-event smeserver-mysql-update
config set mysqld service access public status enabled TCPPort 3306 signal-event remoteaccess-update signal-event reboot
Keep in mind this enables access to your MariaDB/MySQL database for ANYONE, so make sure you have strong passwords on ALL your MariaDB/MySQL databases. Alternatively it would be a more secure approach to require external (remote) users to establish a VPN connection and effectively become part of the local network. In that case do not change the mysql access to public status using the above command.
Create MariaDB/MySQL user(s) with access from other computers
SME Server's default MariaDB/MySQL database users, and most of the database examples in the wiki, allow login only from localhost.
If you want to access a MariaDB/MySQL database on your SME server from other computers, you must not only make the configuration changes described above, you must also create a user who is allowed to login from those systems (see 5.5.4. Access Control, Stage 1: Connection Verification for more detail).
Allow mysql login from any LAN workstation
Assuming your local network is 192.168.1.0, you can create a user with MariaDB/MySQL access from any LAN workstation (or VPN client) using the command shown below (courtesy of DarkMirage).
You probably want to change:
- the database name (MyDB)
- the user name (MyUser)
- the password (MyPW) and
- the allowed computers (192.168.1.%)
## In the command below, \ escapes a linebreak. ## Either include them, or place the entire command on one line mysql -e "\ create database MyDB; \ GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER \ ON *.* \ TO 'MyUser'@'192.168.1.%' \ IDENTIFIED BY 'MyPW'; \ FLUSH PRIVILEGES;"
Security Implications of allowing remote MariaDB/MySQL login
It is technically possible to combine the above techniques to allow remote MariaDB/MySQL login from any host on the Internet (allow network login, open the firewall, then set the network address to '%'). This would be a bad idea.
If you have remote users who need access to your MariaDB/MySQL database(s), encourage them to use a VPN connection, or an SSH tunnel, or (at a minimum), restrict the allowed login hosts to their internet IP address. On top of that, you are encouraged to enforce encrypted connection at the level of you MariaDB/MySQL service to avoid any clear text exchange on the LAN or worse on the Internet.
Enable InnoDB engine
To enable the InnoDB engine, run the following commands:
db configuration setprop mysqld InnoDB enabled expand-template /etc/my.cnf sv t /service/mysqld
To disable the InnoDB engine, run the following commands:
db configuration setprop mysqld InnoDB disabled expand-template /etc/my.cnf sv t /service/mysqld
Administration
Information about user managament can be found in the MySQL User Account Management section of the MySQL manual, which holds a lot of useful information, a small section is listed here for convenience.
Create a new database
- See the developers guide if you wish to automate the creation of a database within an rpm
or
- Get access to the SME Server shell and issue the following commands:
mysqladmin create 'dbname' --default-character-set=utf8
This will create an empty database called dbname.
Creating MySQL user(s)
Decide which permissions you will have to give to the user on what database. Details about this can be found in the MariaDB/MySQL Manual found at the MariaDB/MySQL site. Get access to the SME Server shell and issue the following commands to login to the MySQL server:
mysql
Suppose we want to create a user which has read-only access on all tables in the database called 'test':
GRANT SELECT ON test.* TO 'user'@'host' IDENTIFIED BY 'password';
In the above line you will have to fill in the user and the host and/or domain from which you will allow the user access to the SME Server MariaDB/MySQL server (don't forget the single quotes). More information can be found in the MariaDB/MySQL Server Manual at the MariaDB/MySQL website linked here.
Listing available databases
To view a list of available databases on the system you can issue the following command while logged in in MariaDB/MySQL:
show databases;
Remove a database
Get access to the SME Server shell and MariaDB/MySQL and issue the following command:
drop database databasename;
Replace databasename with the name of the database.
Remove a user
Get access to the SME Server shell and MariaDB/MySQL and issue the following command:
USE mysql; DELETE FROM user WHERE user = 'username'; FLUSH PRIVILEGES;
Replace username with the username you wish to delete.
Optimizing MariaDB/MySQL default settings for SME 10
Here are the available settings from the configuration database to tweak you MariaDB service. If no default value indicated, please refers the the manual of your database version for its own default value:
| key | default | Role |
|---|---|---|
| innodb_file_format | barracuda | |
| innodb_file_per_table | 1 | |
| LocalNetworkingOnly | no | |
| OpenFilesLimit | 0 | |
| MaxConnections | ||
| WaitTimeout | ||
| QueryCacheLimit | ||
| QueryCacheSize | 1M | |
| QueryCacheType | 1 | |
| SortBufferSize | ||
| ReadRndBufferSize | ||
| TableOpenCache | ||
| TableOpenCacheInstances | ||
| TmpTableSize | ||
| MaxHeapTableSize | ||
| ThreadCacheSize | 256 | |
| KeyBufferSize | key_buffer_size | |
| MyisamSortBufferSize | myisam_sort_buffer_size | |
| JoinBufferSize | 262144 | |
| ReadBufferSize | ||
| MaxConnectErrors | ||
| ConnectTimeout | 100 | |
| MaxAllowedPacket | 16M | |
| SlowQueries |
to alter a value, just do
config set mariadb KeyBufferSize 18M MyisamSortBufferSize 8M expand-template /etc/my.cnf systemctl restart mariadb
if your needed option is not available then create a dedicated template custom. Be careful to use a name starting with a number between 016 and 039.
mkdir -p /etc/e-smith/templates-custom/etc/my.cnf/ vim /etc/e-smith/templates-custom/etc/my.cnf/017myvalues expand-template /etc/my.cnf systemctl restart mariadb
Optimizing MariaDB/MySQL default settings for up to SME9
SME Server uses MariaDB/MySQL for the webmail package, and the default configuration is optimized for that.
If you are using the SME server to provide MariaDB/MySQL databases for functions running on workstations, you may need to adjust some of the default MariaDB/MySQL parameters. Keep in mind it is difficult to optimize MYSQL for a number of different applications, as default values that are suitable for one application may not be suitable for another. In determining appropriate settings for MariaDB/MySQL, you will also need to consider the system resources & general specification of the server that MariaDB/MySQL is running on.
Pointers for tuning and optimizing the databases can be found at http://www.mysqlperformanceblog.com/2006/09/29/what-to-tune-in-mysql-server-after-installation/ and http://lists.mysql.com/mysql/214398 and specifically re key_buffer_size at http://lists.mysql.com/mysql/214398
The following example comes from this forum thread http://forums.contribs.org/index.php/topic,46694.0.html and refers to this bug report http://bugs.contribs.org/show_bug.cgi?id=6287
To change the following parameters
key_buffer_size=18M myisam_sort_buffer_size=8M
Create a custom template fragment & edit it to include your required parameters
mkdir -p /etc/e-smith/templates-custom/etc/my.cnf/ vim /etc/e-smith/templates-custom/etc/my.cnf/016mysetup
Save & Exit
Ctrl o Ctrl x
Expand the changes & restart mysql
expand-template /etc/my.cnf sv t /service/mysqld
Check /etc/my.cnf to see that the changes are reflected.
Later versions of applications
Why does SME Server still not have PHP 5, MySql4, Apach2, xxx
SME Server 7.x is based on Centos 4.x which in term is based on RedHat Enterprise Linux 4.x. Since the development team is limited in person and time, all work is done in spare time, we do not have the time to implement such big changes and cope with the maintenance of such work.
Is xxx on SME Server still safe to run?
Yes, because security fixes and bug fixes are backported to the 4.x releases and they are propagated to the users as updates, for more information have a look at http://www.redhat.com/security/updates/backporting.
Can I install a later version of xxx
Yes, but you are then responsible for updates and possible conflicts with updates
For example see this page for PHP#PHP_5 PHP updates and warnings
